QNAP TS-464

From Wiki-IoT
Revision as of 15:48, 21 October 2026 by Huixin Lin (talk | contribs)

Evidence review: 2026-10-21. Overall IDRS grade: not assigned.

All 12 criteria are investigated below. A documented capability, a historical vulnerability and an observed current configuration are different evidence types. Unresolved values are explicitly not scored; absence of a public report is not evidence of absence.

This page uses an evidence table because the current Classification calculator accepts only three scored choices and cannot represent unknown values safely. It does not change the shared template or assign an unsupported grade.

Product information

Field Verified value / stated scope
Name QNAP TS-464
Brand QNAP
Model TS-464; hardware specifications refer to TS-464-4G
Operating System QTS 5.2.x assessment baseline; individual installed build unknown.
Cpu Intel Celeron N5095, four cores, burst up to 2.9 GHz
Gpu Intel UHD Graphics
Memory 4 GB DDR4 (4G variant)
Storage 4 GB flash; four SATA drive bays and two M.2 slots; drive capacity unspecified
Connectivity Two 2.5 GbE ports; HDMI 2.1; USB
Dimensions 165 x 170 x 226.5 mm
Mass 2.26 kg (reviewed 4G variant)
Type NAS
Website https://www.qnap.com/en/product/ts-464/specs/hardware/TS-464-4G.pdf
Release Date 2022-09-05 (official launch announcement; regional sale dates can differ)

Assessment scope

TS-464 family; TS-464-4G used for hardware specs. QTS 5.2.x capability baseline; 5.2.9.3410 build 20260214 is a compatible example, not claimed latest. HTTPS, MFA, access protection and QuLog logging are conditional settings.

No physical device, installed firmware, password, network trace or storage image was inspected. Conditional capability assessments apply only when the named settings are enabled.

Security evaluation

Device

Criterion Finding / rubric choice Evidence and reasoning
Known hardware tampering Physical reset and removable storage; not rated The hardware specification and QTS guide document removable drives, ports and a reset button. Physical reset can restore administrator/network settings. This establishes an exposure requiring physical protection, not a measured tampering rate. TS-464-4G hardware QTS 5.2 user guide
Known vulnerabilities Confirmed vulnerabilities; frequency not quantified The records below establish historical vulnerabilities within the stated firmware scope. They do not measure prevalence or establish a Rare/Very common frequency rating. ZDI-24-470 TS-464 QNAP QSA-24-09
Prior attacks QNAP platform ransomware; TS-464 rate unknown QNAP documented a September 2022 DeadBolt campaign against internet-exposed NAS systems using vulnerable Photo Station. The notice does not identify TS-464 victims. January 2022 campaigns predate this model launch and cannot establish its attack history. QNAP DeadBolt response, September 2022 QNAP TS-x64 launch announcement
Updatability Very common (CRIS 1; scoped assessment) A 2026 compatible QTS release and firmware-update mechanisms are documented. QTS 5.2.9.3410 release QTS 5.2 system settings

System

Criterion Finding / rubric choice Evidence and reasoning
Authentication with other systems Not rated: insufficient evidence Certificates and authenticated services exist; guest access and all mutual-authentication paths need review. QTS 5.2 system settings QTS 5.2 privilege settings
Communications Encrypted with up-to-date encryption (CRIS 1; scoped assessment) Assumes current HTTPS/encrypted transfers and disabled plaintext alternatives. QTS 5.2 system settings
Storage Flash encryption not established; volume encryption distinct QTS supports optional encrypted data storage, but this is not evidence that all boot flash or configuration is encrypted. Optional encryption also does not imply an obsolete cipher. A whole-device flash rating is withheld. TS-464-4G hardware QTS 5.2 user guide

User authentication

Criterion Finding / rubric choice Evidence and reasoning
Account management Full (CRIS 1; scoped assessment) User/group privileges support least-privilege management when configured. QTS 5.2 privilege settings
Authentication Basic recovery boundary; MFA available (CRIS 2; scoped assessment) QTS supports two-step verification. A physical basic reset can re-enable the admin account and restore its version-dependent default credential, so the recovery boundary requires physical protection. This is a conservative Basic assessment; it does not imply MFA is unavailable. QTS 5.2 user guide QTS default administrator credentials
Brute-force protection Exist (CRIS 1; scoped assessment) IP/account access protection is available; enable service-specific thresholds. QTS 5.2 system settings QTS 5.2 IP protection
Event logging Access event logged (CRIS 1; scoped assessment) QuLog supports access logs and failed HTTP/HTTPS login events when logging is enabled. QTS 5.2 access logs QuLog failed-login example
Passwords Unique device credential / change policy; complexity configurable For QTS 5.2+, the default admin account is normally disabled; reset re-enables it with the unique device Cloud Key. Manually re-enabling it requires a different password. Earlier versions used MAC-derived or common credentials. Password complexity is configurable, so no universal active-policy claim is made. QTS default administrator credentials QTS 5.2 password policy

Rating calculation

No definitive category score or GRAS is calculated while one or more required CRIS values are unresolved. The method requires taking the ceiling of each complete category mean and summing the three category scores. An unknown must not be substituted with 1 or treated as None. Wiki-IoT methodology

Historical vulnerabilities and remediation

CVE-2024-21899: Configuration change / improper authentication

  • Affected scope: ZDI explicitly names TS-464; vendor QTS 5.x fix reference is 5.1.3.2578 build 20231110.
  • Preconditions: Primary sources differ: ZDI says no authentication; vendor summary mentions user access. Reconcile before asserting prerequisites.
  • Impact: Unauthorized configuration modification.
  • Remediation: QTS 5.1.3.2578 build 20231110 and later for QTS 5.x, vendor.
  • Severity: ZDI CVSS v3: 9.1; AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H.

CVE-2024-21900: Injection affecting QTS

  • Affected scope: QSA-24-09 covers QTS 5.x; relevant to TS-464 only with susceptible QTS. Not a separately verified model exploit.
  • Preconditions: Remote attacker with user access, vendor.
  • Impact: Arbitrary command execution.
  • Remediation: QTS 5.1.3.2578 build 20231110 and later, QTS 5.x branch.
  • Severity: Numeric score not independently verified; omitted.

Product evidence notes

Retrieved from "http://fehmijaafar.net/wiki-iot/index.php?title=QNAP_TS-464&oldid=8652"