QNAP addresses critical flaws across NAS, router software

QNAP published security advisories addressing multiple critical and high-severity vulnerabilities across Notes Station 3, QuRouter, QTS/QuTS Hero, AI Core, and QuLog Center—most notably remote command-injection and authentication bypass flaws (e.g., CVE-2024-38643, CVE-2024-48860) that could enable unauthorized access or remote code execution; QNAP provided fixed versions and urges users to update immediately and avoid exposing devices directly to the Internet.