QNAP release patches piecemeal

Although QNAP has been made aware of security flaws in their surveillance software, they continue to release patches piecemeal.

The first release updated the Surveillance Station Pro software to version 3.0.1 (the latest version is 3.0.2), although this update was only applicable to NAS systems with firmware version 4. There are still systems with the older firmware version 3.8 in operation, and these systems continue to be vulnerable. The company initially responded with silence – and a short time later, with Surveillance Station Pro v2.6.

The company's web pages offer neither information on the nature of the problem nor on how to fix it. The only updating tips can be found in a posting by a QNAP employee on a forum for registered users. As the security hole, and potential ways of exploiting it, are already being discussed on the relevant forums, administrators should act immediately.