QNAP vulnerability disclosure ends up an utter shambles

QNAP disclosed and released fixes for two command-injection vulnerabilities in its QTS/QuTS firmware (CVE-2023-50358 and CVE-2023-47218), with Unit42 publishing a technical breakdown showing how unauthenticated input to quick.cgi can lead to arbitrary command execution; the advisory and vendor patches cover many firmware branches while the German BSI warned of potential "major damage." Unit42's internet scans found about 289,665 exposed devices worldwide, there is disagreement between QNAP's moderate CVSS assignment and researchers' higher-impact assessment, and users are urged to apply the provided patches or mitigations promptly.