QNAP TS-464
From Wiki-IoT
| QNAP TS-464 | ||
|---|---|---|
|
Security Grade
Calculator v1
|
QNAP TS-464
Brand: QNAP Category: NAS • Model / Gen: TS-464 (QTS) Release Date: 2022-01-01 • Status: In sale Classification Date: 2026-10-21 • [www.qnap.com/ Official Website] | |
Contents
Security Evaluation
1. Device Security
| Criterion | Value | Proof | Comment |
|---|---|---|---|
| Known hardware tampering | Rare | [www.qnap.com/en/security-advisory/qsa-24-54 🔗 Proof] | No mass physical-tampering campaign; issues are remote/network. |
| Known vulnerabilities | Very common | [nvd.nist.gov/vuln/detail/CVE-2024-50393 🔗 Proof] | CVE-2024-50393 (CVSS 9.8): unauthenticated command injection in QTS/QuTS hero allows remote code execution. Also CVE-2024-32766 (CVSS 10.0 command injection) and CVE-2024-53692. |
| Prior attacks | Very common | [www.qnap.com/en/security-advisory/qsa-24-54 🔗 Proof] | QNAP NAS devices have been targeted by DeadBolt and Qlocker ransomware campaigns at scale. |
| Updatability | Very common | [www.qnap.com/en/security-advisory/qsa-24-54 🔗 Proof] | QNAP ships frequent QTS firmware updates; live-update available. |
| Category Score | Score: 3 / 3 | ||
2. System Security
| Criterion | Value | Proof | Comment |
|---|---|---|---|
| Authentication with other systems | Full | [www.qnap.com/ 🔗 Proof] | Integrates LDAP/Active Directory, SMB, NFS, and cloud services with mutual authentication. |
| Communications | Encrypted with up-to-date encryption | [www.qnap.com/ 🔗 Proof] | HTTPS/TLS for management and remote access. |
| Storage | Encrypted with obselete encryption | [www.qnap.com/ 🔗 Proof] | Volume encryption is available but optional, not on by default. |
| Category Score | Score: 2 / 3 | ||
3. User Authentication
| Criterion | Value | Proof | Comment |
|---|---|---|---|
| Account management | Full | [www.qnap.com/ 🔗 Proof] | Multi-user accounts, groups and role-based permissions. |
| Authentication | Basic | [nvd.nist.gov/vuln/detail/CVE-2024-50393 🔗 Proof] | Unauthenticated command injection (CVE-2024-50393) bypasses the login boundary. |
| Brute-force protection | Basic | [www.qnap.com/ 🔗 Proof] | Basic failed-login limits; no strong documented lockout policy. |
| Event logging | Access event logged | [www.qnap.com/ 🔗 Proof] | NAS logs access/login events and provides audit logs. |
| Passwords | Require change after setup | [www.qnap.com/ 🔗 Proof] | Initial admin password set at setup; complexity enforcement varies. |
| Category Score | Score: 2 / 3 | ||
Technical Specifications
| Property | Details |
|---|---|
| Operating System & App | QTS (Companion App: Qfile / QuMagie) |
| Hardware (CPU / GPU) | CPU: Intel Celeron N5095 • GPU: Intel UHD Graphics |
| Memory & Storage | Memory: 4 GB (expandable) • Storage: 4-bay (HDD/SSD) |
| Power, Battery & Charging | Battery: N/A • Power: External AC adapter • Charging: N/A |
| Display & Camera | Display: N/A • Camera: N/A |
| Sound & Connectivity | Sound: N/A • Connectivity: 2 x 2.5GbE, USB 3.2, HDMI |
| Physical (Dimensions & Mass) | Dimensions: Approx. 168 x 170 x 226 mm • Mass: Approx. 2.26 kg |
