CVE-2024-32764

CRITICAL

A missing authentication for critical function vulnerability has been reported to affect myQNAPcloud Link. If exploited, the vulnerability could allow users with the privilege level of some functio...

Affects 1 product across 1 vendor.

BCS6.75
CVSS 3.19.9
EPSS0.4%
Percentile35th
PatchPatched
CVSS Vector — Plain English Remotely exploitable over the network, low complexity, no authentication required, no user interaction needed, can impact systems beyond the vulnerable component, full integrity impact.
CWE Weakness Definitions
CWE-306: Missing Authentication for Critical Function

Software does not perform any authentication for functionality that requires a verified identity.

CWE-346: CWE-346
CWE-749: CWE-749
Related Attack Patterns (CAPEC)
CAPEC-59 Session Credential Falsification through Prediction
via CWE-346
CAPEC-60 Reusing Session IDs (aka Session Replay)
via CWE-346
CAPEC-76 Manipulating Web Input to File System Calls
via CWE-346
CAPEC-142 DNS Cache Poisoning
via CWE-346
CAPEC-385 Transaction or Event Tampering via Application API Manipulation
via CWE-346
Show all 22

Mapping is CWE-to-CAPEC per MITRE CAPEC 3.9.

◆ SAGE Intelligence — CITED Relevance Research Team

A critical vulnerability (CVE-2024-32764) in myQNAPcloud Link allows unauthorized access to critical functions due to a missing authentication mechanism. This could lead to significant security risks if exploited.

BSID: BS-2024-GLOBAL-192331-C • Model: /workspace/models/qwen2.5-coder-32b-instruct-bf16 • Confidence: HIGH

Is this CVE in your environment?

BreachSpider monitors your ICS/OT environment for vulnerabilities like this one. No agents or network access required. Free to start.

Check My Environment →
Frequently Asked Questions
What is CVE-2024-32764?
A critical vulnerability (CVE-2024-32764) in myQNAPcloud Link allows unauthorized access to critical functions due to a missing authentication mechanism. This could lead to significant security risks if exploited.
What is the CVSS score for CVE-2024-32764?
CVE-2024-32764 has CVSS 9.9 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:L. EPSS: 0.4%.
Is CVE-2024-32764 actively exploited?
No confirmed active exploitation of CVE-2024-32764 as of 2026-05-30.
How do I remediate CVE-2024-32764?
Priority: IMMEDIATE. Advisory: https://www.qnap.com/en/security-advisory/qsa-24-09 PSIRT: [email protected]
What systems are affected by CVE-2024-32764?
CVE-2024-32764 affects: Qnap.
Vulnerability Details
CVE IDCVE-2024-32764
BSIDBS-2024-GLOBAL-192331-C BreachSpider Global ID
CVSS VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:L
Published2024-04-26
Last Modified2025-12-10
ICS Relevance70%
Weakness (CWE)
Missing Authentication for Critical FunctionCWE-346CWE-749
SourceNVD
Official Description

A missing authentication for critical function vulnerability has been reported to affect myQNAPcloud Link. If exploited, the vulnerability could allow users with the privilege level of some functionality via a network. We have already fixed the vulnerability in the following version: myQNAPcloud Link 2.4.51 and later

Source: NIST NVD / MITRE CVE Database

Attack Vector Analysis — CITED Relevance

The vulnerability can be exploited by an attacker with the privilege level of some functionality via a network. The attacker could potentially gain unauthorized access to critical functions of the myQNAPcloud Link service.

Exploitation Likelihood: HIGH

Affected Products
VendorProductFixed Version
Qnap Myqnapcloud Link —
Remediation
View Vendor Advisory →

Remediation Priority: IMMEDIATE

Vendor PSIRT: [email protected]
Threat Intelligence
● Threat Intelligence Validated: August 2026 | Threat Age: 833 Days
CISA KEVNot in KEV catalog
Public ExploitNot confirmed
PoC CodeNot confirmed
SAGE Enrichment Record — provenance & audit hash
Model/workspace/models/qwen2.5-coder-32b-instruct-bf16
ConfidenceHIGH
Enriched At2026-05-24
SHA-512 Audit Hash518fb0446c5c0730c6e4af5bd22d20a541a7b6b32b9b591d45328b8d956f989c44b199fdf50f448da53722b8443791245dc4bcd9ef7d46c3e2bf49609d867567
Related CVEs affecting Qnap
CVE-2017-7876 10.0 This command injection vulnerability in QTS allows attackers to run arbitrary... CVE-2024-32766 10.0 An OS command injection vulnerability has been reported to affect several QNA... CVE-2026-22901 9.8 A command injection vulnerability has been reported to affect QuNetSwitch. If... CVE-2025-59388 9.8 A use of hard-coded password vulnerability has been reported to affect Hyper ... CVE-2025-59385 9.8 An authentication bypass by spoofing vulnerability has been reported to affec...
View all Qnap CVEs →

Critical Severity - Know Your Exposure

A CVSS 9.9 vulnerability in your ICS environment cannot wait. BreachSpider maps critical CVEs to your specific assets and tells you what to fix first.

Check Your Assets Free →