Medium severity5.5NVD Advisory· Published Sep 21, 2009· Updated Apr 23, 2026
CVE-2009-3278
CVE-2009-3278
Description
The QNAP TS-239 Pro and TS-639 Pro with firmware 2.1.7 0613, 3.1.0 0627, and 3.1.1 0815 use the rand library function to generate a certain recovery key, which makes it easier for local users to determine this key via a brute-force attack.
Affected products
6cpe:2.3:o:qnap:ts-239_pro_firmware:2.1.7:build0613:*:*:*:*:*:*+ 2 more
- cpe:2.3:o:qnap:ts-239_pro_firmware:2.1.7:build0613:*:*:*:*:*:*
- cpe:2.3:o:qnap:ts-239_pro_firmware:3.1.0:build0627:*:*:*:*:*:*
- cpe:2.3:o:qnap:ts-239_pro_firmware:3.1.1:build0815:*:*:*:*:*:*
cpe:2.3:o:qnap:ts-639_pro_firmware:2.1.7:build0613:*:*:*:*:*:*+ 2 more
- cpe:2.3:o:qnap:ts-639_pro_firmware:2.1.7:build0613:*:*:*:*:*:*
- cpe:2.3:o:qnap:ts-639_pro_firmware:3.1.0:build0627:*:*:*:*:*:*
- cpe:2.3:o:qnap:ts-639_pro_firmware:3.1.1:build0815:*:*:*:*:*:*
Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
4- www.baseline-security.de/downloads/BSC-Qnap_Crypto_Backdoor-CVE-2009-3200.txtnvdExploit
- www.securityfocus.com/archive/1/506607/100/0/threadednvdBroken LinkThird Party AdvisoryVDB Entry
- www.securityfocus.com/bid/36467nvdBroken LinkThird Party AdvisoryVDB Entry
- secunia.com/advisories/36793nvdBroken Link
News mentions
0No linked articles in our index yet.