You do not have permission to edit this page, for the following reasons:
'''Evidence review addendum — 2026-10-24. Public-document review; ratings with evidence gaps remain provisional.''' This addendum supersedes earlier inconsistent wording on the same fields. It is based on public documents and the saved website snapshot; no installed device was tested. Historical research below remains historical evidence. Unverified flash protection and interface-specific controls are not verified device facts. == Documented basic information == * 电源: 90 W adapter; AC input 100–240 V (TS-464-4G) [https://www.qnap.com/en/product/ts-464/specs/hardware/TS-464-4G.pdf Source] * 声音: System warning buzzer [https://www.qnap.com/en/product/ts-464/specs/hardware/TS-464-4G.pdf Source] * 连接方式: 2 × 2.5 GbE; HDMI 2.1; 2 USB 2.0 + 2 USB 3.2 Gen 2 Type-A [https://www.qnap.com/en/product/ts-464/specs/hardware/TS-464-4G.pdf Source] == Revised security evidence notes == * 闪存存储加密: The official recovery guide includes TS-464 and writes its system image to the DOM block device. This is indirect boot-image evidence, not proof that all flash elements lack at-rest encryption. [https://www.qnap.com/en/how-to/faq/article/nas-recovery-guide-for-x86-based-nas Source] * 账号管理: QTS 5.2 supports user creation, password changes, shared-folder/application permissions and deletion of ordinary users. Default user accounts are an explicit deletion exception. Actual local configuration was not inspected. [https://docs.qnap.com/operating-system/qts/5.2.x/en-us/modifying-user-account-information-E4B52002.html Source] [https://docs.qnap.com/operating-system/qts/5.2.x/en-us/creating-multiple-users-3377B960.html Source] [https://docs.qnap.com/operating-system/qts/5.2.x/en-us/deleting-users-926E2A50.html Source] * 防暴力破解: QTS 5.2 IP Access Protection can block client IPs by failed-login count within a time window, with configurable protocols and block duration. Actual settings were not inspected. [https://docs.qnap.com/operating-system/qts/5.2.x/en-us/configuring-ip-access-protection-18286EFA.html Source] [https://www.qnap.com/es-es/release-notes/qts/5.2.3.3006/20250108 Source] == Scoring status == Existing selected scores are a saved comparison baseline, not newly validated final scores. Recheck version, region and assessment path before updating options. Recalculate CATS/GRAS and synchronize this section after all selected options are settled. Do not infer a secure or insecure flash state from a downloadable firmware image or encrypted data volumes. ---- '''Assessment reviewed 2026-10-22. This is a documented capability assessment with explicitly labelled assessor inferences, not a test of an individual installed NAS.''' == Assessment scope == TS-464 family; TS-464-4G used for hardware specs. QTS 5.2.x capability baseline; 5.2.9.3410 build 20260214 is a compatible example, not claimed latest. HTTPS, MFA, access protection and QuLog logging are conditional settings. Where the rubric gives no numerical Rare/Very common thresholds, comments state the qualitative mapping. Prior-attack platform evidence is explicitly separated from confirmed model-specific incidents. A configuration-dependent benefit applies only when its named setting is enabled. Release date is the official TS-x64 launch announcement, 5 September 2022; regional first-sale dates can differ. [https://www.qnap.com/tr-tr/news/2022/qnap-introduces-the-new-ts-x64-2-5gbe-nas-integrated-with-intel-celeron-quad-core-processors QNAP TS-x64 launch announcement] == Calculation cross-check == Device CRIS: 2, 2, 2, 1; CATS 2. System CRIS: 2, 1, 3; CATS 2. User Authentication CRIS: 1, 2, 1, 1, 2; CATS 2. GRAS 6; expected grade B. The automatic template preview must agree before saving. [https://fehmijaafar.net/wiki-iot/index.php/Methodology Methodology] == Evidence and inference notes == * Known hardware tampering: ASSESSOR INFERENCE: Rare denotes a local-possession barrier, not measured incident frequency. Drive trays, USB/HDMI and the reset control permit physical modification/recovery, while enclosure and drive locks add limited resistance. Physical custody is assumed; the device is not rated tamper-proof. [https://www.qnap.com/en/product/ts-464/specs/hardware/TS-464-4G.pdf TS-464-4G hardware] [https://docs.qnap.com/operating-system/qts/5.2.x/qts5.2.x-ug-en-us.pdf QTS 5.2 user guide] * Known vulnerabilities: ASSESSOR INFERENCE: Rare is the qualitative bucket for the limited verified historical set in this review (CVE-2024-21899 and CVE-2024-21900), not a population prevalence estimate. These issues were fixed before the QTS 5.2.x capability baseline; historical exposure and current patch status are separate. [https://www.zerodayinitiative.com/advisories/ZDI-24-470/ ZDI-24-470 TS-464] [https://www.qnap.com/en/security-advisory/qsa-24-09 QNAP QSA-24-09] * Prior attacks: ASSESSOR INFERENCE: Rare is a cautious platform-history estimate based on the September 2022 QNAP/Photo Station DeadBolt campaign, after this model was announced. The vendor does not enumerate TS-464 victims; applying the shared QTS/app history to this model is an inference, not a confirmed model infection count. January 2022 incidents are excluded because they predate launch. [https://www.qnap.com/en-us/security-news/2022/qnaps-response-action-and-statement-to-recent-deadbolt-attacks QNAP DeadBolt response, September 2022] [https://www.qnap.com/tr-tr/news/2022/qnap-introduces-the-new-ts-x64-2-5gbe-nas-integrated-with-intel-celeron-quad-core-processors QNAP TS-x64 launch announcement] * Updatability: A 2026 compatible QTS release and firmware-update mechanisms are documented. [https://www.qnap.com/en-us/release-notes/qts/5.2.9.3410/20260214 QTS 5.2.9.3410 release] [https://docs.qnap.com/operating-system/qts/5.2.x/en-us/system-settings-185B1271.html QTS 5.2 system settings] * Authentication with other systems: Partial describes the supported service set: administrative and account services require login, while deliberately enabled SMB guest access can work without credentials. Guest access is disabled by default. This is not a claim that every QTS connection has mutual certificate authentication. [https://www.qnap.com/en-us/how-to/faq/article/how-can-i-share-folders-with-guest-users QNAP guest access, QTS 4.4.1 and later] [https://docs.qnap.com/operating-system/qts/5.2.x/en-us/configuring-privilege-settings-E1272B37.html QTS 5.2 privilege settings] * Communications: Assumes current HTTPS/encrypted transfers and disabled plaintext alternatives. [https://docs.qnap.com/operating-system/qts/5.2.x/en-us/system-settings-185B1271.html QTS 5.2 system settings] * Storage: ASSESSOR INFERENCE, boot-flash scope: the TS-464 recovery guide exposes the DOM as a normal block device and restores a public generic system image directly, without a device-specific decryption step. This supports No encryption for boot-image elements under the flash criterion. Optional encrypted data volumes are separate; it does not establish plaintext storage of every user file or secret. [https://www.qnap.com/en/how-to/faq/article/nas-recovery-guide-for-x86-based-nas QNAP x86 NAS recovery guide, includes TS-464] [https://www.qnap.com/en/product/ts-464/specs/hardware/TS-464-4G.pdf TS-464-4G hardware] * Account management: User/group privileges support least-privilege management when configured. [https://docs.qnap.com/operating-system/qts/5.2.x/en-us/configuring-privilege-settings-E1272B37.html QTS 5.2 privilege settings] * Authentication: QTS supports two-step verification. A physical basic reset can re-enable the admin account and restore its version-dependent default credential, so the recovery boundary requires physical protection. This is a conservative Basic assessment; it does not imply MFA is unavailable. [https://docs.qnap.com/operating-system/qts/5.2.x/qts5.2.x-ug-en-us.pdf QTS 5.2 user guide] [https://www.qnap.com/en-us/how-to/faq/article/what-is-the-default-system-administrator-password-for-my-nas QTS default administrator credentials] * Brute-force protection: IP/account access protection is available; enable service-specific thresholds. [https://docs.qnap.com/operating-system/qts/5.2.x/en-us/system-settings-185B1271.html QTS 5.2 system settings] [https://docs.qnap.com/operating-system/qts/5.2.x/en-us/configuring-ip-access-protection-18286EFA.html QTS 5.2 IP protection] * Event logging: QuLog supports access logs and failed HTTP/HTTPS login events when logging is enabled. [https://docs.qnap.com/operating-system/qts/5.2.x/en-us/local-access-logs-8761937.html QTS 5.2 access logs] [https://www.qnap.com/en/how-to/faq/article/how-do-i-send-notifications-for-access-logs-and-logs-from-a-remote-qulog-center QuLog failed-login example] * Passwords: QTS 5.2 normally disables the built-in admin; reset uses the device-unique Cloud Key, and manual re-enabling requires a different password. The rubric accepts unique pre-installed credentials. The closest 2-point bucket is used because character-complexity rules are configurable, not universally enforced. Earlier MAC/common-password versions are outside this baseline. [https://www.qnap.com/en-us/how-to/faq/article/what-is-the-default-system-administrator-password-for-my-nas QTS default administrator credentials] [https://docs.qnap.com/operating-system/qts/5.2.x/en-us/configuring-the-password-policy-BDEDEB1D.html QTS 5.2 password policy] == Historical vulnerabilities and remediation == === CVE-2024-21899: Configuration change / improper authentication === * Affected scope: ZDI explicitly names TS-464; vendor QTS 5.x fix reference is 5.1.3.2578 build 20231110. * Preconditions: Primary sources differ: ZDI says no authentication; vendor summary mentions user access. Reconcile before asserting prerequisites. * Impact: Unauthorized configuration modification. * Remediation: QTS 5.1.3.2578 build 20231110 and later for QTS 5.x, vendor. * Severity: ZDI CVSS v3: 9.1; AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H. * Evidence: [https://www.zerodayinitiative.com/advisories/ZDI-24-470/ ZDI-24-470 TS-464] [https://www.qnap.com/en/security-advisory/qsa-24-09 QNAP QSA-24-09] === CVE-2024-21900: Injection affecting QTS === * Affected scope: QSA-24-09 covers QTS 5.x; relevant to TS-464 only with susceptible QTS. Not a separately verified model exploit. * Preconditions: Remote attacker with user access, vendor. * Impact: Arbitrary command execution. * Remediation: QTS 5.1.3.2578 build 20231110 and later, QTS 5.x branch. * Severity: Numeric score not independently verified; omitted. * Evidence: [https://www.qnap.com/en/security-advisory/qsa-24-09 QNAP QSA-24-09]
For new submissions, pages will appear blank until approval.
Summary: This is a minor edit Watch this page
Save page Show preview Show changes Cancel
