QNAP warns of critical auth bypass flaw in its NAS devices

QNAP disclosed three vulnerabilities affecting QTS, QuTS hero, QuTScloud and myQNAPcloud — an unauthenticated remote authentication bypass (CVE-2024-21899) and two authenticated flaws enabling command injection (CVE-2024-21900) and SQL injection (CVE-2024-21901). The advisory lists affected versions, provides patched version numbers and update instructions, and warns that internet-exposed NAS devices are attractive targets for ransomware families such as DeadBolt, Checkmate, and Qlocker.