【資安漏洞預警】QNAP NAS應用程式存在高風險安全漏洞(CVE-2025-59384與CVE-2025-59387)，請儘速確認並進行修補

【行政公告】

公告單位	圖資處數位服務組
訊息類別	行政公告行政公告	公告對象	全體
公告主題	【資安漏洞預警】QNAP NAS應用程式存在高風險安全漏洞(CVE-2025-59384與CVE-2025-59387)，請儘速確認並進行修補 [Security Vulnerability Alert] The QNAP NAS application contains high-risk security vulnerabilities (CVE-2025-59384 and CVE-2025-59387). Please confirm and patch them as soon as possible.
公告內容	轉發國家資安資訊分享與分析中心資安訊息警訊 NISAC-200-202601-00000099 [內容說明] 研究人員發現QNAP NAS應用程式存在高風險安全漏洞，請儘速確認並進行修補。 1.Qfiling存在路徑遍歷(Path Traversal)漏洞(CVE-2025-59384)，未經身分鑑別之遠端攻擊者可利用此漏洞讀取未授權之檔案或系統資料。 2.MARS(Multi-Application Recovery Service)存在SQL注入(SQL Injection)漏洞(CVE-2025-59387)，未經身分鑑別之遠端攻擊者可注入並執行未授權指令。 [影響平台] Qfiling 3.13.x至3.13.1(不含)版本 MARS 1.2.x至1.2.1.1686(不含)版本 [建議措施] 官方已針對漏洞釋出修復更新，請參考官方說明進行更新，網址如下： https://www.qnap.com/en/security-advisory/qsa-25-54 https://www.qnap.com/en/security-advisory/qsa-25-53 [參考資料] 1. https://nvd.nist.gov/vuln/detail/CVE-2025-59384 2. https://nvd.nist.gov/vuln/detail/CVE-2025-59387 3. https://www.qnap.com/en/security-advisory/qsa-25-54 4. https://www.qnap.com/en/security-advisory/qsa-25-53 Forwarded from National Cybersecurity Information Sharing and Analysis Center: Cybersecurity Alert NISAC-200-202601-00000099 [Content Description] Researchers have discovered a high-risk security vulnerability in the QNAP NAS application. Please confirm and patch it as soon as possible. 1. Qfiling has a Path Traversal vulnerability (CVE-2025-59384). An unauthenticated remote attacker could exploit this vulnerability to read unauthorized files or system data. 2. MARS (Multi-Application Recovery Service) has an SQL Injection vulnerability (CVE-2025-59387). An unauthenticated remote attacker could inject and execute unauthorized commands. [Affected Platforms] Qfiling versions 3.13.x to 3.13.1 (excluding 3.13.1) MARS versions 1.2.x to 1.2.1.1686 (excluding 1.2.1.1686) [Recommended Actions] The official patch for this vulnerability has been released. Please refer to the official instructions for updating. The URLs are as follows: https://www.qnap.com/en/security-advisory/qsa-25-54 https://www.qnap.com/en/security-advisory/qsa-25-53 [References] 1. https://nvd.nist.gov/vuln/detail/CVE-2025-59384 2. https://nvd.nist.gov/vuln/detail/CVE-2025-59387 3. https://www.qnap.com/en/security-advisory/qsa-25-54 4. https://www.qnap.com/en/security-advisory/qsa-25-53
相關訊息
公告時間	2026/1/14 至 2026/7/14	點閱次數	133