{"id":"CVE-2020-2506","kind":"vulnerability","aliases":["CVE-2020-2506"],"related":[],"title":"QNAP Systems Helpdesk: QNAP Helpdesk Improper Access Control Vulnerability","description":"The vulnerability have been reported to affect earlier versions of QTS. If exploited, this improper access control vulnerability could allow attackers to compromise the security of the software by gaining privileges, or reading sensitive information. This issue affects: QNAP Systems Inc. Helpdesk versions prior to 3.0.3.","summary":"QNAP Helpdesk, a vendor support ticketing product, has an improper access control flaw. An attacker could gain privileges or read sensitive information.","severity":"critical","cvss":9.8,"epss":0.01982,"exploited":true,"exploited_at":"2022-03-25T00:00:00+00:00","products":[{"name":"QNAP Systems Helpdesk","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["exploited","helpdesk","qnap","vendor"],"not_affected_if":["unknown"],"how_to_check":null,"fix":"Apply updates per vendor instructions (CISA KEV required action); specific fixed version unknown.","status":"open","published_at":"2021-02-03T16:15:13+00:00","first_seen_at":"2026-10-23T19:11:52+00:00","triaged_at":"2026-10-23T21:21:56+00:00","updated_at":"2026-10-23T21:57:35+00:00","category":"vendor","confidence":0.5,"triage":{"at":"2026-10-23T21:21:56Z","model":"claude-haiku-5-5","output":{"fix":"Apply updates per vendor instructions (CISA KEV required action); specific fixed version unknown.","reach":"unknown","impact":"high","summary":"QNAP Helpdesk, a vendor support ticketing product, has an improper access control flaw. An attacker could gain privileges or read sensitive information.","category":"vendor","who_cares":["qnap","helpdesk"],"confidence":0.5,"needs_auth":"unknown","worst_case":"Attacker gains elevated privileges and reads sensitive data.","analyst_note":"Exploited in the wild per CISA KEV; find the affected and fixed versions and the QNAP advisory at https://www.qnap.com/en/security-advisory and check whether the attack needs auth or network access.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["unknown"],"user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000449,"input_tokens":2834,"output_tokens":332,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2020':11A,14A '-2506':12A,15A '3.0.3':90C 'access':7A,33B,60C 'affect':51C,82C 'allow':64C 'attack':37B,65C 'compromis':67C 'control':8A,34B,61C 'could':38B,63C 'cve':10A,13A 'earlier':52C 'exploit':19B,57C 'flaw':35B 'gain':39B,74C 'helpdesk':3A,5A,18A,20B,24B,86C 'improp':6A,32B,59C 'inc':85C 'inform':44B,79C 'issu':81C 'prior':88C 'privileg':40B,75C 'product':29B 'qnap':1A,4A,16A,21B,23B,83C 'qts':55C 'read':42B,77C 'report':49C 'secur':69C 'sensit':43B,78C 'softwar':72C 'support':27B 'system':2A,84C 'systems':17A 'ticket':28B 'vendor':22B,26B 'version':53C,87C 'vulner':9A,46C,62C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2021-02-03T16:15:13+00:00","kev":{"dateAdded":"2022-03-25","dueDate":"2022-04-15","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","cvss_by":"security@qnapsecurity.com.tw","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2020-2506","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2020-2506","severity":null,"published_at":"2022-03-25T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:52+00:00","fetched_at":"2026-10-25T10:39:07+00:00","note":null},{"source":"epss","external_id":"CVE-2020-2506","url":"https://api.first.org/data/v1/epss?cve=CVE-2020-2506","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:44+00:00","fetched_at":"2026-10-23T19:13:44+00:00","note":null},{"source":"nvd","external_id":"CVE-2020-2506","url":"https://nvd.nist.gov/vuln/detail/CVE-2020-2506","severity":null,"published_at":"2021-02-03T16:15:13+00:00","modified_at":"2026-06-17T03:12:15+00:00","first_seen_at":"2026-10-23T21:57:35+00:00","fetched_at":"2026-10-23T21:57:35+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}