b2b-daily
Home | IT | Cyber Security

QNAP Addresses Critical Zero-Day Flaw in QuRouter, Urges Immediate Update

Avatar photo
by Tailor Jackson
November 11, 2024
QNAP Addresses Critical Zero-Day Flaw in QuRouter, Urges Immediate Update

QNAP Systems, Inc., a leading provider of network-attached storage (NAS) and networking solutions, has announced the release of a critical security update for its QuRouter devices. This update addresses a zero-day vulnerability that was discovered during the Pwn2Own 2024 competition. The newly released firmware promptly patches this flaw, which could have potentially allowed unauthorized access to the affected devices.

The Viettel Cyber Security team identified the vulnerability during the Pwn2Own hacking contest, which underscores the significance of such events in uncovering and resolving potential security threats. QNAP’s swift response not only highlights the company’s dedication to maintaining the security and integrity of its products but also reassures users of their commitment to protecting their networks and data.

Importance of Updating QuRouter Devices

The identified zero-day flaw, officially designated as CVE-2024-50389, affects QuRouter version 2.4.x. The fix for this flaw has been implemented in version 2.4.5.032 and subsequent versions. Given the critical nature of this vulnerability, QNAP strongly advises all QuRouter users to update their devices immediately.

To update their QuRouter devices, users should follow these instructions:

  1. Log in to the QuRouter interface
  2. Go to the Firmware section
  3. Click “Update now”
  4. Select the “Latest” version
  5. Click “Apply” and confirm the update

The update process will automatically download and install the latest firmware, thereby protecting the device against the discovered vulnerability. For users who prefer manual updates or have limited internet connectivity on their QuRouter devices, QNAP has made the latest firmware available for download from their Download Center. Users can perform a manual update by going to Firmware > Manual Update in the QuRouter interface.

Ensuring Device Security and Performance

Keeping devices updated is crucial for benefiting from vulnerability fixes, new features, and performance improvements. QNAP highlights the necessity of regular firmware updates to ensure the security and functionality of their devices.

The keen identification and swift mitigation of the zero-day flaw underline the importance of security researchers and events like Pwn2Own in spotting and resolving potential vulnerabilities before malicious actors can exploit them. QNAP’s quick response demonstrates its commitment to protecting users and maintaining customer trust.

Given the continually evolving cybersecurity landscape, manufacturers and users must remain vigilant and proactive in addressing security issues. QNAP’s timely patch release serves as a strong reminder of the ongoing need for regular software updates and maintaining a solid security posture in today’s interconnected digital world.

Users should check their QuRouter firmware version and promptly update to the latest version to protect their devices from security risks. Staying current with the latest firmware updates greatly enhances the security and reliability of networks and data, safeguarding them against emerging threats and vulnerabilities.

Information Security

Explore more

Digital Transformation Enhances Safety in Port Operations
June 17, 2026

The sheer scale of modern maritime hubs often obscures the daily physical risks faced by the dockworkers who navigate a labyrinth of heavy machinery and moving containers. Historically, these environments have functioned as high-stakes arenas where the margins for error are razor-thin and the consequences of a momentary lapse in judgment are often fatal. Despite the industrial importance of these

Ransomware Attack on Mackay Sugar Halts Australian Harvest
June 17, 2026

The precision required to manage a modern industrial sugar harvest relies on a delicate synchronization of heavy machinery, logistics software, and thousands of workers across North Queensland’s vast agricultural landscape. When this digital backbone was severed by a ransomware attack in June 2026, the consequences resonated far beyond the server rooms of Mackay Sugar, impacting the livelihood of an entire

Did ShinyHunters Really Steal Millions of Kodak Records?
June 17, 2026

The digital underworld erupted with speculation after a prominent cybercriminal organization known as ShinyHunters claimed to have breached the internal databases of the Eastman Kodak Company. This alleged infiltration supposedly resulted in the exfiltration of millions of sensitive records, casting a long shadow over the legacy imaging firm’s modern digital infrastructure and its ability to safeguard corporate assets in an

Attackers Shift Focus From Passwords to OAuth Token Hijacking
June 17, 2026

The digital perimeter has undergone a profound transformation as adversaries abandon the brute-force tactics of yesterday in favor of more sophisticated methods that exploit the very protocols designed to secure our interconnected cloud environments. While many security teams remain preoccupied with complex password policies and rotating credentials, sophisticated threat actors have shifted their attention toward the exploitation of OAuth tokens,

Malicious JetBrains Plugins Steal Thousands of AI API Keys
June 17, 2026

The modern Integrated Development Environment has transformed from a simple text editor into a complex hub of automated intelligence, but this evolution has opened a dangerous new frontier for cybercriminal activity. A massive malware operation recently breached the JetBrains Marketplace, leveraging at least 15 deceptive plugins to harvest sensitive AI API keys from unsuspecting software engineers who rely on these