{"id":"CVE-2020-2506","aliases":["EUVD-2020-22299","GHSA-vph4-5mf4-28v5"],"status":"published","title":"improper access control vulnerability in Helpdesk","description":"The vulnerability have been reported to affect earlier versions of QTS. If exploited, this improper access control vulnerability could allow attackers to compromise the security of the software by gaining privileges, or reading sensitive information. This issue affects: QNAP Systems Inc. Helpdesk versions prior to 3.0.3.","severity":{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.02006,"percentile":0.8099,"model":"v2026.06.15"},"facts":{"in_kev":true,"known_exploited":true,"public_exploit":false,"fix_available":false},"cwes":["CWE-284","CWE-863"],"published":"2021-02-03T15:51:38Z","modified":"2026-06-17T03:12:15Z","kev":{"date_added":"2022-03-25","due_date":"2022-04-15","required_action":"Apply updates per vendor instructions.","known_ransomware_use":"Unknown"},"exploitation":[{"source":"euvd","since":"2022-03-25"},{"source":"kev","since":"2022-03-25"}],"products":[{"vendor":"gfi software","product":"helpdesk"},{"vendor":"qnap","product":"helpdesk"},{"vendor":"qnap systems","product":"helpdesk"},{"vendor":"qnap systems inc.","product":"helpdesk"}],"references":[{"url":"https://www.qnap.com/zh-tw/security-advisory/qsa-20-08","tags":["x_refsource_MISC","x_transferred","Vendor Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-2506","tags":["government-resource","US Government Resource"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-2506"},{"url":"https://github.com/advisories/GHSA-vph4-5mf4-28v5"}],"sources":{"cve":[{"id":"CVE-2020-2506","title":"improper access control vulnerability in Helpdesk","description":"The vulnerability have been reported to affect earlier versions of QTS. If exploited, this improper access control vulnerability could allow attackers to compromise the security of the software by gaining privileges, or reading sensitive information. This issue affects: QNAP Systems Inc. Helpdesk versions prior to 3.0.3.","status":"published","published":"2021-02-03T15:51:38.031Z","modified":"2025-10-21T23:35:29.111Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high","assessor":"cna"}],"cwes":["CWE-284"],"updated_at":"2026-11-02T14:35:51.563355Z"}],"euvd":[{"id":"EUVD-2020-22299","description":"The vulnerability have been reported to affect earlier versions of QTS. If exploited, this improper access control vulnerability could allow attackers to compromise the security of the software by gaining privileges, or reading sensitive information. This issue affects: QNAP Systems Inc. Helpdesk versions prior to 3.0.3.","status":"published","published":"2021-02-03T15:51:38Z","modified":"2025-10-21T23:35:29Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high"}],"exploited_since":"2022-03-25","updated_at":"2026-11-02T20:31:25.308373Z"}],"ghsa":[{"id":"GHSA-vph4-5mf4-28v5","title":"The vulnerability have been reported to affect earlier versions of QTS. If exploited, this...","description":"The vulnerability have been reported to affect earlier versions of QTS. If exploited, this improper access control vulnerability could allow attackers to obtain control of a QNAP device. This issue affects: QNAP Systems Inc. Helpdesk versions prior to 3.0.3.","status":"published","published":"2022-05-24T17:40:47Z","modified":"2025-10-22T00:33:07Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-284","CWE-863"],"updated_at":"2026-11-02T15:04:07.67458Z"}],"kev":[{"id":"CVE-2020-2506","title":"QNAP Helpdesk Improper Access Control Vulnerability","description":"QNAP Helpdesk contains an improper access control vulnerability which could allow an attacker to gain privileges or to read sensitive information.","cwes":["CWE-284"],"kev":{"date_added":"2022-03-25","due_date":"2022-04-15","required_action":"Apply updates per vendor instructions.","known_ransomware_use":"Unknown"},"updated_at":"2026-11-02T17:00:16.541131Z"}],"nvd":[{"id":"CVE-2020-2506","description":"The vulnerability have been reported to affect earlier versions of QTS. If exploited, this improper access control vulnerability could allow attackers to compromise the security of the software by gaining privileges, or reading sensitive information. This issue affects: QNAP Systems Inc. Helpdesk versions prior to 3.0.3.","status":"published","published":"2021-02-03T16:15:13.807Z","modified":"2026-06-17T03:12:15.06Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high","assessor":"secondary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-284"],"updated_at":"2026-11-02T14:06:34.188486Z"}]}}