# CVE-2020-2506

The vulnerability have been reported to affect earlier versions of QTS. If exploited, this improper access control vulnerability could allow attackers to compromise the security of the software by gaining privileges, or reading sensitive information. This issue affects: QNAP Systems Inc. Helpdesk versions prior to 3.0.3.

- Page: https://www.vulneraibility.com/cve/CVE-2020-2506
- CVSS: 7.3
- Known exploited: yes, in CISA KEV since 2022-03-25; CISA due date 2022-04-15
- EPSS: 2.01% (percentile 81.1)
- CISA SSVC: exploitation active, automatable yes, technical impact partial (assessed 2025-02-06)
- Weakness: CWE-284
- Published: 2021-02-03

## Affected versions

- QNAP Systems Inc. Helpdesk: affected < 3.0.3

A version outside these ranges is not a statement that it is unaffected.

## References

- [other] https://www.qnap.com/zh-tw/security-advisory/qsa-20-08
- [other] https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-2506

---
Summary, impact and action are written by the vulneraibility.com AI analysis pipeline from the CVE record, NVD, CISA and FIRST data; verify against the references.