QNAP patches second zero-day exploited at Pwn2Own to get root

QNAP issued emergency patches for two zero-day vulnerabilities disclosed at Pwn2Own Ireland 2024 — notably CVE-2024-50387, an SQL injection in the SMB Service that enabled root access on a TS-464 NAS — and advises administrators to update affected QuTS/QTS components. The advisory highlights the high-risk profile of internet-exposed QNAP devices, citing past ransomware families (eCh0raix, DeadBolt, Checkmate) that have leveraged NAS vulnerabilities and weak credentials, and recommends prompt patching to mitigate potential compromise.