VULNERABILITY INTELLIGENCE

CVE-2020-2500

CVSS score9.8 CRITICAL
EPSS probability0.74%
CISA KEVNot currently listed
Published2020-07-01
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Description

This improper access control vulnerability in Helpdesk allows attackers to get control of QNAP Kayako service. Attackers can access the sensitive data on QNAP Kayako server with API keys. We have replaced the API key to mitigate the vulnerability, and already fixed the issue in Helpdesk 3.0.1 and later versions.

Weakness classification

  • CWE-284: Improper Access Control
  • CWE-321: Use of Hard-coded Cryptographic Key
  • CWE-798: Use of Hard-coded Credentials

Primary references