QNAP Extends Security Updates to Certain NAS Systems

QNAP will extend critical security updates to certain NAS systems even though they have an end-of-life status. Such devices will now receive security updates until October 2022.

Normally, QNAP provides security updates to its eol systems for four years. The company now says it will continue to update select NAS systems through October to protect against “evolving security threats” and give users more time to upgrade their devices to a newer model.

These are x86-64bit devices and nas systems with an Arm chip that currently run older versions of QTS. Specifically, these are QTS versions 4.2.6 and 4.3.3 from May 2017, 4.3.6 from March 2019 and 4.4.1 from September 2019. The updates are limited to patches for vulnerabilities classified as ‘high’ or ‘critical’ .

QNAP also advises users not to “expose” EOL NAS devices to the Internet to protect them from unpatched vulnerabilities. The company already issued that advice in January, when ransomware was circulating targeting QNAP systems accessible via the Internet. That concerned, for example, DeadBolt. Qlocker also reappeared in January, Bleeping Computer wrote. QNAP also called on users to turn off their NAS’ upnp function and disable port forwarding in their router.