Experts released PoC exploit code for RCE in QNAP QTS

Researchers from WatchTowr Labs disclosed fifteen vulnerabilities affecting QNAP QTS, QuTScloud, and QTS hero, highlighting CVE-2024-27130 — an unsafe strcpy in share.cgi leading to a stack buffer overflow and potential remote code execution. Technical details and proof-of-concept exploit code were published; only four of the fifteen flaws were patched by QNAP in April 2024, while the remainder remain unpatched, under embargo, or accepted by the vendor without fixes.