QNAP TS-464
From Wiki-IoT
Security Evaluation
1. Device Security
2. System Security
3. User Authentication
Technical Specifications
Assessment reviewed 2026-10-22. This is a documented capability assessment with explicitly labelled assessor inferences, not a test of an individual installed NAS.
Assessment scope
TS-464 family; TS-464-4G used for hardware specs. QTS 5.2.x capability baseline; 5.2.9.3410 build 20260214 is a compatible example, not claimed latest. HTTPS, MFA, access protection and QuLog logging are conditional settings.
Where the rubric gives no numerical Rare/Very common thresholds, comments state the qualitative mapping. Prior-attack platform evidence is explicitly separated from confirmed model-specific incidents. A configuration-dependent benefit applies only when its named setting is enabled.
Release date is the official TS-x64 launch announcement, 5 September 2022; regional first-sale dates can differ. QNAP TS-x64 launch announcement
Calculation cross-check
Device CRIS: 2, 2, 2, 1; CATS 2. System CRIS: 2, 1, 3; CATS 2. User Authentication CRIS: 1, 2, 1, 1, 2; CATS 2. GRAS 6; expected grade B. The automatic template preview must agree before saving. Methodology
Evidence and inference notes
- Known hardware tampering: ASSESSOR INFERENCE: Rare denotes a local-possession barrier, not measured incident frequency. Drive trays, USB/HDMI and the reset control permit physical modification/recovery, while enclosure and drive locks add limited resistance. Physical custody is assumed; the device is not rated tamper-proof. TS-464-4G hardware QTS 5.2 user guide
- Known vulnerabilities: ASSESSOR INFERENCE: Rare is the qualitative bucket for the limited verified historical set in this review (CVE-2024-21899 and CVE-2024-21900), not a population prevalence estimate. These issues were fixed before the QTS 5.2.x capability baseline; historical exposure and current patch status are separate. ZDI-24-470 TS-464 QNAP QSA-24-09
- Prior attacks: ASSESSOR INFERENCE: Rare is a cautious platform-history estimate based on the September 2022 QNAP/Photo Station DeadBolt campaign, after this model was announced. The vendor does not enumerate TS-464 victims; applying the shared QTS/app history to this model is an inference, not a confirmed model infection count. January 2022 incidents are excluded because they predate launch. QNAP DeadBolt response, September 2022 QNAP TS-x64 launch announcement
- Updatability: A 2026 compatible QTS release and firmware-update mechanisms are documented. QTS 5.2.9.3410 release QTS 5.2 system settings
- Authentication with other systems: Partial describes the supported service set: administrative and account services require login, while deliberately enabled SMB guest access can work without credentials. Guest access is disabled by default. This is not a claim that every QTS connection has mutual certificate authentication. QNAP guest access, QTS 4.4.1 and later QTS 5.2 privilege settings
- Communications: Assumes current HTTPS/encrypted transfers and disabled plaintext alternatives. QTS 5.2 system settings
- Storage: ASSESSOR INFERENCE, boot-flash scope: the TS-464 recovery guide exposes the DOM as a normal block device and restores a public generic system image directly, without a device-specific decryption step. This supports No encryption for boot-image elements under the flash criterion. Optional encrypted data volumes are separate; it does not establish plaintext storage of every user file or secret. QNAP x86 NAS recovery guide, includes TS-464 TS-464-4G hardware
- Account management: User/group privileges support least-privilege management when configured. QTS 5.2 privilege settings
- Authentication: QTS supports two-step verification. A physical basic reset can re-enable the admin account and restore its version-dependent default credential, so the recovery boundary requires physical protection. This is a conservative Basic assessment; it does not imply MFA is unavailable. QTS 5.2 user guide QTS default administrator credentials
- Brute-force protection: IP/account access protection is available; enable service-specific thresholds. QTS 5.2 system settings QTS 5.2 IP protection
- Event logging: QuLog supports access logs and failed HTTP/HTTPS login events when logging is enabled. QTS 5.2 access logs QuLog failed-login example
- Passwords: QTS 5.2 normally disables the built-in admin; reset uses the device-unique Cloud Key, and manual re-enabling requires a different password. The rubric accepts unique pre-installed credentials. The closest 2-point bucket is used because character-complexity rules are configurable, not universally enforced. Earlier MAC/common-password versions are outside this baseline. QTS default administrator credentials QTS 5.2 password policy
Historical vulnerabilities and remediation
CVE-2024-21899: Configuration change / improper authentication
- Affected scope: ZDI explicitly names TS-464; vendor QTS 5.x fix reference is 5.1.3.2578 build 20231110.
- Preconditions: Primary sources differ: ZDI says no authentication; vendor summary mentions user access. Reconcile before asserting prerequisites.
- Impact: Unauthorized configuration modification.
- Remediation: QTS 5.1.3.2578 build 20231110 and later for QTS 5.x, vendor.
- Severity: ZDI CVSS v3: 9.1; AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H.
- Evidence: ZDI-24-470 TS-464 QNAP QSA-24-09
CVE-2024-21900: Injection affecting QTS
- Affected scope: QSA-24-09 covers QTS 5.x; relevant to TS-464 only with susceptible QTS. Not a separately verified model exploit.
- Preconditions: Remote attacker with user access, vendor.
- Impact: Arbitrary command execution.
- Remediation: QTS 5.1.3.2578 build 20231110 and later, QTS 5.x branch.
- Severity: Numeric score not independently verified; omitted.
- Evidence: QNAP QSA-24-09
