QNAP TS-464

QNAP TS-464
Security Grade B Calculator v	QNAP TS-464 Brand: QNAP Category: NAS • Model / Gen: TS-464; hardware specifications refer to TS-464-4G Release Date: 2022-09-05 • Status: Classification Date: • Official Website

Security Evaluation

1. Device Security

Criterion	Value	Proof	Comment
Known hardware tampering	Rare	[1] 🔗 Proof	ASSESSOR INFERENCE: Rare denotes a local-possession barrier, not measured incident frequency. Drive trays, USB/HDMI and the reset control permit physical modification/recovery, while enclosure and drive locks add limited resistance. Physical custody is assumed; the device is not rated tamper-proof.
Known vulnerabilities	Rare	[2] 🔗 Proof	ASSESSOR INFERENCE: Rare is the qualitative bucket for the limited verified historical set in this review (CVE-2024-21899 and CVE-2024-21900), not a population prevalence estimate. These issues were fixed before the QTS 5.2.x capability baseline; historical exposure and current patch status are separate.
Prior attacks	Rare	[3] 🔗 Proof	ASSESSOR INFERENCE: Rare is a cautious platform-history estimate based on the September 2022 QNAP/Photo Station DeadBolt campaign, after this model was announced. The vendor does not enumerate TS-464 victims; applying the shared QTS/app history to this model is an inference, not a confirmed model infection count. January 2022 incidents are excluded because they predate launch.
Updatability	Very common	[4] 🔗 Proof	SCOPED ASSESSMENT: A 2026 compatible QTS release and firmware-update mechanisms are documented.
Category Score	Score: 2 / 3

2. System Security

Criterion	Value	Proof	Comment
Authentication with other systems	Partial	[5] 🔗 Proof	Partial describes the supported service set: administrative and account services require login, while deliberately enabled SMB guest access can work without credentials. Guest access is disabled by default. This is not a claim that every QTS connection has mutual certificate authentication.
Communications	Encrypted with up-to-date encryption	🔗 Proof	SCOPED ASSESSMENT: Assumes current HTTPS/encrypted transfers and disabled plaintext alternatives.
Storage	No encryption	[6] 🔗 Proof	ASSESSOR INFERENCE, boot-flash scope: the TS-464 recovery guide exposes the DOM as a normal block device and restores a public generic system image directly, without a device-specific decryption step. This supports No encryption for boot-image elements under the flash criterion. Optional encrypted data volumes are separate; it does not establish plaintext storage of every user file or secret.
Category Score	Score: 2 / 3

3. User Authentication

Criterion	Value	Proof	Comment
Account management	Full	🔗 Proof	SCOPED ASSESSMENT: User/group privileges support least-privilege management when configured.
Authentication	Basic	[7] 🔗 Proof	SCOPED ASSESSMENT: QTS supports two-step verification. A physical basic reset can re-enable the admin account and restore its version-dependent default credential, so the recovery boundary requires physical protection. This is a conservative Basic assessment; it does not imply MFA is unavailable.
Brute-force protection	Exist	[8] 🔗 Proof	SCOPED ASSESSMENT: IP/account access protection is available; enable service-specific thresholds.
Event logging	Access event logged	[9] 🔗 Proof	SCOPED ASSESSMENT: QuLog supports access logs and failed HTTP/HTTPS login events when logging is enabled.
Passwords	Require change after setup	[10] 🔗 Proof	QTS 5.2 normally disables the built-in admin; reset uses the device-unique Cloud Key, and manual re-enabling requires a different password. The rubric accepts unique pre-installed credentials. The closest 2-point bucket is used because character-complexity rules are configurable, not universally enforced. Earlier MAC/common-password versions are outside this baseline.
Category Score	Score: 2 / 3

Technical Specifications

Property	Details
Operating System & App	QTS 5.2.x assessment baseline; individual installed build unknown. (Companion App: )
Hardware (CPU / GPU)	CPU: Intel Celeron N5095, four cores, burst up to 2.9 GHz • GPU: Intel UHD Graphics
Memory & Storage	Memory: 4 GB DDR4 (4G variant) • Storage: 4 GB flash; four SATA drive bays and two M.2 slots; drive capacity unspecified
Power, Battery & Charging	Battery: • Power: • Charging:
Display & Camera	Display: • Camera:
Sound & Connectivity	Sound: • Connectivity: Two 2.5 GbE ports; HDMI 2.1; USB
Physical (Dimensions & Mass)	Dimensions: 165 x 170 x 226.5 mm • Mass: 2.26 kg (reviewed 4G variant)

Assessment reviewed 2026-10-22. This is a documented capability assessment with explicitly labelled assessor inferences, not a test of an individual installed NAS.

Assessment scope

TS-464 family; TS-464-4G used for hardware specs. QTS 5.2.x capability baseline; 5.2.9.3410 build 20260214 is a compatible example, not claimed latest. HTTPS, MFA, access protection and QuLog logging are conditional settings.

Where the rubric gives no numerical Rare/Very common thresholds, comments state the qualitative mapping. Prior-attack platform evidence is explicitly separated from confirmed model-specific incidents. A configuration-dependent benefit applies only when its named setting is enabled.

Release date is the official TS-x64 launch announcement, 5 September 2022; regional first-sale dates can differ. QNAP TS-x64 launch announcement

Calculation cross-check

Device CRIS: 2, 2, 2, 1; CATS 2. System CRIS: 2, 1, 3; CATS 2. User Authentication CRIS: 1, 2, 1, 1, 2; CATS 2. GRAS 6; expected grade B. The automatic template preview must agree before saving. Methodology

Evidence and inference notes

• Known hardware tampering: ASSESSOR INFERENCE: Rare denotes a local-possession barrier, not measured incident frequency. Drive trays, USB/HDMI and the reset control permit physical modification/recovery, while enclosure and drive locks add limited resistance. Physical custody is assumed; the device is not rated tamper-proof. TS-464-4G hardware QTS 5.2 user guide
• Known vulnerabilities: ASSESSOR INFERENCE: Rare is the qualitative bucket for the limited verified historical set in this review (CVE-2024-21899 and CVE-2024-21900), not a population prevalence estimate. These issues were fixed before the QTS 5.2.x capability baseline; historical exposure and current patch status are separate. ZDI-24-470 TS-464 QNAP QSA-24-09
• Prior attacks: ASSESSOR INFERENCE: Rare is a cautious platform-history estimate based on the September 2022 QNAP/Photo Station DeadBolt campaign, after this model was announced. The vendor does not enumerate TS-464 victims; applying the shared QTS/app history to this model is an inference, not a confirmed model infection count. January 2022 incidents are excluded because they predate launch. QNAP DeadBolt response, September 2022 QNAP TS-x64 launch announcement
• Updatability: A 2026 compatible QTS release and firmware-update mechanisms are documented. QTS 5.2.9.3410 release QTS 5.2 system settings
• Authentication with other systems: Partial describes the supported service set: administrative and account services require login, while deliberately enabled SMB guest access can work without credentials. Guest access is disabled by default. This is not a claim that every QTS connection has mutual certificate authentication. QNAP guest access, QTS 4.4.1 and later QTS 5.2 privilege settings
• Communications: Assumes current HTTPS/encrypted transfers and disabled plaintext alternatives. QTS 5.2 system settings
• Storage: ASSESSOR INFERENCE, boot-flash scope: the TS-464 recovery guide exposes the DOM as a normal block device and restores a public generic system image directly, without a device-specific decryption step. This supports No encryption for boot-image elements under the flash criterion. Optional encrypted data volumes are separate; it does not establish plaintext storage of every user file or secret. QNAP x86 NAS recovery guide, includes TS-464 TS-464-4G hardware
• Account management: User/group privileges support least-privilege management when configured. QTS 5.2 privilege settings
• Authentication: QTS supports two-step verification. A physical basic reset can re-enable the admin account and restore its version-dependent default credential, so the recovery boundary requires physical protection. This is a conservative Basic assessment; it does not imply MFA is unavailable. QTS 5.2 user guide QTS default administrator credentials
• Brute-force protection: IP/account access protection is available; enable service-specific thresholds. QTS 5.2 system settings QTS 5.2 IP protection
• Event logging: QuLog supports access logs and failed HTTP/HTTPS login events when logging is enabled. QTS 5.2 access logs QuLog failed-login example
• Passwords: QTS 5.2 normally disables the built-in admin; reset uses the device-unique Cloud Key, and manual re-enabling requires a different password. The rubric accepts unique pre-installed credentials. The closest 2-point bucket is used because character-complexity rules are configurable, not universally enforced. Earlier MAC/common-password versions are outside this baseline. QTS default administrator credentials QTS 5.2 password policy

Historical vulnerabilities and remediation

CVE-2024-21899: Configuration change / improper authentication

• Affected scope: ZDI explicitly names TS-464; vendor QTS 5.x fix reference is 5.1.3.2578 build 20231110.

• Preconditions: Primary sources differ: ZDI says no authentication; vendor summary mentions user access. Reconcile before asserting prerequisites.

• Impact: Unauthorized configuration modification.

• Remediation: QTS 5.1.3.2578 build 20231110 and later for QTS 5.x, vendor.

• Severity: ZDI CVSS v3: 9.1; AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H.

• Evidence: ZDI-24-470 TS-464 QNAP QSA-24-09

CVE-2024-21900: Injection affecting QTS

• Affected scope: QSA-24-09 covers QTS 5.x; relevant to TS-464 only with susceptible QTS. Not a separately verified model exploit.

• Preconditions: Remote attacker with user access, vendor.

• Impact: Arbitrary command execution.

• Remediation: QTS 5.1.3.2578 build 20231110 and later, QTS 5.x branch.

• Severity: Numeric score not independently verified; omitted.

• Evidence: QNAP QSA-24-09