CVE-2020-2504: 
NixOS vulnerability analysis and mitigation

CVE-2020-2504 is an absolute path traversal vulnerability affecting QNAP NAS systems running QES (QNAP Enterprise Storage) operating system. The vulnerability was discovered and reported by TIM Security Red Team Research, and was publicly disclosed on December 23, 2020. If exploited, this vulnerability could allow attackers to traverse files in File Station (QNAP Advisory).

The vulnerability is classified as a path traversal issue (CWE-22: Improper Limitation of a Pathname to a Restricted Directory). It received a CVSS v3.1 base score of 7.5 (HIGH) from NIST NVD with vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, while QNAP assessed it with a score of 5.8 (MEDIUM) with vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N (NVD).

The vulnerability could allow attackers to traverse files in File Station, potentially exposing sensitive information stored on affected QNAP NAS devices (QNAP Advisory).

The vulnerability requires network access but no authentication or user interaction to exploit, as indicated by the CVSS vector strings. No specific details about exploitation in the wild have been publicly reported (NVD).

QNAP has fixed this vulnerability in QES version 2.1.1 Build 20201006 and later. Users are recommended to update their QES to the latest version through the Control Panel > System > Firmware Update path, or by downloading the update manually from the QNAP website's Download Center (QNAP Advisory).