QNAP TS-464

QNAP TS-464
Security Grade B Calculator v1	QNAP TS-464 Brand: QNAP Category: NAS • Model / Gen: TS-464; hardware specifications refer to TS-464-4G Release Date: 2022-09-05 • Status: Classification Date: 2026-10-22 • Official Website

Security Evaluation

1. Device Security

Criterion	Value	Proof	Comment
Known hardware tampering	Rare	[1] 🔗 Proof	ASSESSOR INFERENCE: Rare denotes a local-possession barrier, not measured incident frequency. Drive trays, USB/HDMI and the reset control permit physical modification/recovery, while enclosure and drive locks add limited resistance. Physical custody is assumed; the device is not rated tamper-proof.
Known vulnerabilities	Rare	[2] 🔗 Proof	ASSESSOR INFERENCE: Rare is the qualitative bucket for the limited verified historical set in this review (CVE-2024-21899 and CVE-2024-21900), not a population prevalence estimate. These issues were fixed before the QTS 5.2.x capability baseline; historical exposure and current patch status are separate.
Prior attacks	Rare	[3] 🔗 Proof	ASSESSOR INFERENCE: Rare is a cautious platform-history estimate based on the September 2022 QNAP/Photo Station DeadBolt campaign, after this model was announced. The vendor does not enumerate TS-464 victims; applying the shared QTS/app history to this model is an inference, not a confirmed model infection count. January 2022 incidents are excluded because they predate launch.
Updatability	Very common	[4] 🔗 Proof	SCOPED ASSESSMENT: A 2026 compatible QTS release and firmware-update mechanisms are documented.
Category Score	Score: 2 / 3

2. System Security

Criterion	Value	Proof	Comment
Authentication with other systems	Partial	[5] 🔗 Proof	Partial describes the supported service set: administrative and account services require login, while deliberately enabled SMB guest access can work without credentials. Guest access is disabled by default. This is not a claim that every QTS connection has mutual certificate authentication.
Communications	Encrypted with up-to-date encryption	🔗 Proof	SCOPED ASSESSMENT: Assumes current HTTPS/encrypted transfers and disabled plaintext alternatives.
Storage	No encryption	[6] 🔗 Proof	The official recovery guide includes TS-464 and writes its system image to the DOM block device. This is indirect boot-image evidence, not proof that all flash elements lack at-rest encryption.
Category Score	Score: 2 / 3

3. User Authentication

Criterion	Value	Proof	Comment
Account management	Full	[7] [8] 🔗 Proof	QTS 5.2 supports user creation, password changes, shared-folder/application permissions and deletion of ordinary users. Default user accounts are an explicit deletion exception. Actual local configuration was not inspected.
Authentication	Basic	[9] 🔗 Proof	SCOPED ASSESSMENT: QTS supports two-step verification. A physical basic reset can re-enable the admin account and restore its version-dependent default credential, so the recovery boundary requires physical protection. This is a conservative Basic assessment; it does not imply MFA is unavailable.
Brute-force protection	Exist	[10] 🔗 Proof	QTS 5.2 IP Access Protection can block client IPs by failed-login count within a time window, with configurable protocols and block duration. Actual settings were not inspected.
Event logging	Access event logged	[11] 🔗 Proof	SCOPED ASSESSMENT: QuLog supports access logs and failed HTTP/HTTPS login events when logging is enabled.
Passwords	Require change after setup	[12] 🔗 Proof	QTS 5.2 normally disables the built-in admin; reset uses the device-unique Cloud Key, and manual re-enabling requires a different password. The rubric accepts unique pre-installed credentials. The closest 2-point bucket is used because character-complexity rules are configurable, not universally enforced. Earlier MAC/common-password versions are outside this baseline.
Category Score	Score: 2 / 3

Technical Specifications

Property	Details
Operating System & App	QTS 5.2.x assessment baseline; individual installed build unknown. (Companion App: )
Hardware (CPU / GPU)	CPU: Intel Celeron N5095, four cores, burst up to 2.9 GHz • GPU: Intel UHD Graphics
Memory & Storage	Memory: 4 GB DDR4 (4G variant) • Storage: 4 GB flash; four SATA drive bays and two M.2 slots; drive capacity unspecified
Power, Battery & Charging	Battery: • Power: 90 W adapter; AC input 100–240 V (TS-464-4G) • Charging:
Display & Camera	Display: • Camera:
Sound & Connectivity	Sound: System warning buzzer • Connectivity: 2 × 2.5 GbE; HDMI 2.1; 2 USB 2.0 + 2 USB 3.2 Gen 2 Type-A
Physical (Dimensions & Mass)	Dimensions: 165 x 170 x 226.5 mm • Mass: 2.26 kg (reviewed 4G variant)

Evidence review addendum — 2026-10-24. Public-document review; ratings with evidence gaps remain provisional.

This addendum supersedes earlier inconsistent wording on the same fields. It is based on public documents and the saved website snapshot; no installed device was tested. Historical research below remains historical evidence. Unverified flash protection and interface-specific controls are not verified device facts.

Documented basic information

• 电源: 90 W adapter; AC input 100–240 V (TS-464-4G) Source
• 声音: System warning buzzer Source
• 连接方式: 2 × 2.5 GbE; HDMI 2.1; 2 USB 2.0 + 2 USB 3.2 Gen 2 Type-A Source

Revised security evidence notes

• 闪存存储加密: The official recovery guide includes TS-464 and writes its system image to the DOM block device. This is indirect boot-image evidence, not proof that all flash elements lack at-rest encryption. Source
• 账号管理: QTS 5.2 supports user creation, password changes, shared-folder/application permissions and deletion of ordinary users. Default user accounts are an explicit deletion exception. Actual local configuration was not inspected. Source Source Source
• 防暴力破解: QTS 5.2 IP Access Protection can block client IPs by failed-login count within a time window, with configurable protocols and block duration. Actual settings were not inspected. Source Source

Scoring status

Existing selected scores are a saved comparison baseline, not newly validated final scores. Recheck version, region and assessment path before updating options. Recalculate CATS/GRAS and synchronize this section after all selected options are settled. Do not infer a secure or insecure flash state from a downloadable firmware image or encrypted data volumes.

---

Assessment reviewed 2026-10-22. This is a documented capability assessment with explicitly labelled assessor inferences, not a test of an individual installed NAS.

Assessment scope

TS-464 family; TS-464-4G used for hardware specs. QTS 5.2.x capability baseline; 5.2.9.3410 build 20260214 is a compatible example, not claimed latest. HTTPS, MFA, access protection and QuLog logging are conditional settings.

Where the rubric gives no numerical Rare/Very common thresholds, comments state the qualitative mapping. Prior-attack platform evidence is explicitly separated from confirmed model-specific incidents. A configuration-dependent benefit applies only when its named setting is enabled.

Release date is the official TS-x64 launch announcement, 5 September 2022; regional first-sale dates can differ. QNAP TS-x64 launch announcement

Calculation cross-check

Device CRIS: 2, 2, 2, 1; CATS 2. System CRIS: 2, 1, 3; CATS 2. User Authentication CRIS: 1, 2, 1, 1, 2; CATS 2. GRAS 6; expected grade B. The automatic template preview must agree before saving. Methodology

Evidence and inference notes

• Known hardware tampering: ASSESSOR INFERENCE: Rare denotes a local-possession barrier, not measured incident frequency. Drive trays, USB/HDMI and the reset control permit physical modification/recovery, while enclosure and drive locks add limited resistance. Physical custody is assumed; the device is not rated tamper-proof. TS-464-4G hardware QTS 5.2 user guide
• Known vulnerabilities: ASSESSOR INFERENCE: Rare is the qualitative bucket for the limited verified historical set in this review (CVE-2024-21899 and CVE-2024-21900), not a population prevalence estimate. These issues were fixed before the QTS 5.2.x capability baseline; historical exposure and current patch status are separate. ZDI-24-470 TS-464 QNAP QSA-24-09
• Prior attacks: ASSESSOR INFERENCE: Rare is a cautious platform-history estimate based on the September 2022 QNAP/Photo Station DeadBolt campaign, after this model was announced. The vendor does not enumerate TS-464 victims; applying the shared QTS/app history to this model is an inference, not a confirmed model infection count. January 2022 incidents are excluded because they predate launch. QNAP DeadBolt response, September 2022 QNAP TS-x64 launch announcement
• Updatability: A 2026 compatible QTS release and firmware-update mechanisms are documented. QTS 5.2.9.3410 release QTS 5.2 system settings
• Authentication with other systems: Partial describes the supported service set: administrative and account services require login, while deliberately enabled SMB guest access can work without credentials. Guest access is disabled by default. This is not a claim that every QTS connection has mutual certificate authentication. QNAP guest access, QTS 4.4.1 and later QTS 5.2 privilege settings
• Communications: Assumes current HTTPS/encrypted transfers and disabled plaintext alternatives. QTS 5.2 system settings
• Storage: ASSESSOR INFERENCE, boot-flash scope: the TS-464 recovery guide exposes the DOM as a normal block device and restores a public generic system image directly, without a device-specific decryption step. This supports No encryption for boot-image elements under the flash criterion. Optional encrypted data volumes are separate; it does not establish plaintext storage of every user file or secret. QNAP x86 NAS recovery guide, includes TS-464 TS-464-4G hardware
• Account management: User/group privileges support least-privilege management when configured. QTS 5.2 privilege settings
• Authentication: QTS supports two-step verification. A physical basic reset can re-enable the admin account and restore its version-dependent default credential, so the recovery boundary requires physical protection. This is a conservative Basic assessment; it does not imply MFA is unavailable. QTS 5.2 user guide QTS default administrator credentials
• Brute-force protection: IP/account access protection is available; enable service-specific thresholds. QTS 5.2 system settings QTS 5.2 IP protection
• Event logging: QuLog supports access logs and failed HTTP/HTTPS login events when logging is enabled. QTS 5.2 access logs QuLog failed-login example
• Passwords: QTS 5.2 normally disables the built-in admin; reset uses the device-unique Cloud Key, and manual re-enabling requires a different password. The rubric accepts unique pre-installed credentials. The closest 2-point bucket is used because character-complexity rules are configurable, not universally enforced. Earlier MAC/common-password versions are outside this baseline. QTS default administrator credentials QTS 5.2 password policy

Historical vulnerabilities and remediation

CVE-2024-21899: Configuration change / improper authentication

• Affected scope: ZDI explicitly names TS-464; vendor QTS 5.x fix reference is 5.1.3.2578 build 20231110.

• Preconditions: Primary sources differ: ZDI says no authentication; vendor summary mentions user access. Reconcile before asserting prerequisites.

• Impact: Unauthorized configuration modification.

• Remediation: QTS 5.1.3.2578 build 20231110 and later for QTS 5.x, vendor.

• Severity: ZDI CVSS v3: 9.1; AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H.

• Evidence: ZDI-24-470 TS-464 QNAP QSA-24-09

CVE-2024-21900: Injection affecting QTS

• Affected scope: QSA-24-09 covers QTS 5.x; relevant to TS-464 only with susceptible QTS. Not a separately verified model exploit.

• Preconditions: Remote attacker with user access, vendor.

• Impact: Arbitrary command execution.

• Remediation: QTS 5.1.3.2578 build 20231110 and later, QTS 5.x branch.

• Severity: Numeric score not independently verified; omitted.

• Evidence: QNAP QSA-24-09