dbcve.org
QtsApplication · Qnap

CVE-2021-44054

MEDIUM · 6.1 CVSS v3.1 Published 2022-05-05
Fix available
A fix is available. Upgrade to 4.3.3.1945 / 4.3.4.1976 or later.
See remediation →
68/100
Remediation priority · Elevated
Remotely reachable No privileges

Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.

NVD · unedited
An open redirect vulnerability has been reported to affect QNAP device running QuTScloud, QuTS hero and QTS. If exploited, this vulnerability allows attackers to redirect users to an untrusted page that contains malware. We have already fixed this vulnerability in the following versions of QuTScloud, QuTS hero and QTS: QuTScloud c5.0.1.1949 and later QuTS hero h5.0.0.1949 build 20220215 and later QuTS hero h4.5.4.1951 build 20220218 and later QTS 5.0.0.1986 build 20220324 and later QTS 4.5.4.1991 build 20220329 and later

Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.

dbcve analysis · high confidence

An open redirect vulnerability in QNAP devices running QuTScloud, QuTS hero, and QTS allows attackers to craft malicious URLs that redirect authenticated users to untrusted external websites containing malware.

MitigationUpdate affected QNAP devices to the fixed versions: QuTScloud c5.0.1.1949+, QuTS hero h5.0.0.1949+ (build 20220215) or h4.5.4.1951+ (build 20220218), QTS 5.0.0.1986+ (build 20220324) or QTS 4.5.4.1991+ (build 20220329).

Verify against the referenced sources before acting — the references below are authoritative for this CVE, this summary is not.

Affected products & versions What the vendor confirmedThe version ranges the vendor confirmed as vulnerable. If your version sits inside a range here, treat yourself as exposed until you have upgraded.

NVD · CPE data
QtsApplication
Affected:>= 5.0.0.1716, < 5.0.0.1986>= 4.3.3.0174, < 4.3.3.1945>= 4.3.4.0899, < 4.3.4.1976>= 4.3.6.0895, < 4.3.6.1965>= 4.4.0.0883, < 4.5.4.1991= 4.2.6
Quts HeroOperating system
Affected:< h4.5.4.1771>= h5.0.0.1772, < h5.0.0.1986
QutscloudOperating system
Affected:< c5.0.1.1998

CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.

From the vector
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Scope
Changed
Confidentiality
Low
Integrity
Low
Availability
None

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Am I affected? How to checkSteps we derive from the advisory and the affected-version data, so you can decide whether this CVE reaches your setup. They are a guide, not a scan — your own configuration is the authority.

dbcve checks

Work through these to decide whether this CVE applies to you.

  1. Identify QNAP product type
    Access the device via web UI or CLI. In the QNAP admin interface, go to Control Panel > System > About to see the model and firmware type. The product will display as QTS, QuTS hero, or QuTScloud.
    Affected if Device runs QTS, QuTS hero, or QuTScloud
  2. Determine installed firmware version
    In the QNAP web admin interface, navigate to Control Panel > System > Firmware. The version number is displayed as the Build number. Alternatively, run `cat /etc/config/version` via SSH on the device.
    Affected if Version number is visible and can be compared against affected ranges
  3. Compare QTS version against affected ranges
    If the device runs QTS, verify the build number. Affected versions: 5.0.0.1716 through 5.0.0.1985, 4.3.3.0174 through 4.3.3.1944, 4.3.4.0899 through 4.3.4.1975, 4.3.6.0895 through 4.3.6.1964, 4.4.0.0883 through 4.5.4.1990, or exactly 4.2.6.
    Affected if Installed QTS build number falls within any of the listed affected ranges
  4. Compare QuTS hero version against affected ranges
    If the device runs QuTS hero, check the build number. Affected versions: below h4.5.4.1771, or h5.0.0.1772 through h5.0.0.1985.
    Affected if Installed QuTS hero build number is below h4.5.4.1771 or between h5.0.0.1772 and h5.0.0.1985
  5. Compare QuTScloud version against affected ranges
    If the device runs QuTScloud, check the build number. Affected versions: below c5.0.1.1998.
    Affected if Installed QuTScloud build number is below c5.0.1.1998

The device is affected if it runs any QTS, QuTS hero, or QuTScloud version within the specific build ranges listed for this CVE, and the web interface is accessible (default enabled).

Generated from the published advisory. Verify against your own configuration.

Check your environment

Paste your version and any relevant configuration and it will be compared against the affected criteria above. Do not include secrets or credentials.

AI-assisted, checked against the advisory. Informational, not a guarantee.

Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.

dbcve · scoped
Upgrade available Upgrade to 4.3.3.1945 / 4.3.4.1976 / 4.3.6.1965 or later
Fixed in 4.3.3.19454.3.4.19764.3.6.1965
Interim mitigation

Update affected QNAP devices to the fixed versions: QuTScloud c5.0.1.1949+, QuTS hero h5.0.0.1949+ (build 20220215) or h4.5.4.1951+ (build 20220218), QTS 5.0.0.1986+ (build 20220324) or QTS 4.5.4.1991+ (build 20220329).

Recommended fix High confidence

QTS 5.0.0.1986+ (or QTS 4.5.4.1991+ for legacy); QuTS hero h5.0.0.1949+ or h4.5.4.1951+; QuTScloud c5.0.1.1949+

  1. 1. Identify the current QNAP product type (QTS, QuTS Hero, or QuTScloud) and version number running on the device
  2. 2. For QTS 5.0.x users: Upgrade to QTS 5.0.0.1986 build 20220324 or later
  3. 3. For QTS 4.3.3.x users: Upgrade to QTS 4.3.3.1945 or later
  4. 4. For QTS 4.3.4.x users: Upgrade to QTS 4.3.4.1976 or later
  5. 5. For QTS 4.3.6.x users: Upgrade to QTS 4.3.6.1965 or later
  6. 6. For QuTS hero h5.0.x users: Upgrade to h5.0.0.1949 build 20220215 or later
  7. 7. For QuTS hero h4.5.4.x users: Upgrade to h4.5.4.1951 build 20220218 or later
  8. 8. For QuTScloud users: Upgrade to c5.0.1.1949 or later
Caveat Minor: Ensure backup of configuration before upgrading; some legacy features may be deprecated in newer major versions

Generated from the published advisory — verify against the referenced sources before acting.

Fix this in Qts Scoped from the published advisory
  • Consultation2.0 h
  • Implementation4.0 h
  • Testing2.0 h
  • Review / QA1.0 h
9.0 hours of engineering $1,600
Get the upgrade done

An estimate, not a bill — we confirm scope with you before any work starts. Need it this week? Rush from $2,560.

Scan for this in your stack

Free · runs locally
dbcve dependency scanner

Check whether your project pulls in CVE-2021-44054 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.

Get it on GitHub Scan in the browser

References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.

Primary sources

Practitioner notes

Contributed

Peer-ranked notes from engineers who’ve handled CVE-2021-44054 in production — separate from our analysis above.

No notes yet

Be the first to add a field note for this CVE — a mitigation you’ve verified, a version caveat, or a link to a working fix. Sign in above to contribute.

What this is

A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.

What belongs here
  • Verified mitigations, workarounds, and config changes
  • Version or environment caveats, and links to real fixes
  • No weaponised exploit code, or anything meant to cause harm
  • No spam, self-promotion, credentials, or personal data