QNAP


QTS 5.2.2.2950 build 20241114, the buggy firmware causing these issues, was released this Tuesday for a long list of QTS network-attached storage (NAS) models to patch multiple security vulnerabilities and fix various known issues.
However, according to users who have installed it since then, it also breaks various NAS features and capabilities, including the ability to connect to updated devices that are showing "Your login credentials are incorrect or account is no longer valid" errors even after resets.
"I can no longer connect to my files through the same network; when accessing it through the browser, it remains stuck on the login page, one customer said
  • "When accessing through the myQNAPcloud account, I can connect, but it does not open; I tried restarting, and it did not recover. I tried multiple connection options."
"After updating to the latest QTS it completely broke my SMB shared drives even though the application was up to date. I had to roll back to the previous QTS version and now I am fine," another added.

While the company has yet to release a public statement or advisories regarding these ongoing issues, QNAP's support team has replied to some affected customers, saying that the update has been removed from the downloaded page of impacted NAS models.
QNAP recommends downgrading the firmware to QTS 5.2.1.2930 build 2024102, which should resolve the connectivity and broken apps issues.
"We do have a problem with this 5.2.2 update on some NAS devices related to the DOM secondary partition. The official R&D recommendation is to downgrade the firmware via Qfinder Pro to 5.2.1," QNAP's support team said.
QNAP has yet to reply to several requests for comment made by BleepingComputer earlier today.

Related Articles:

QNAP patches second zero-day exploited at Pwn2Own to get root

QNAP removes backdoor account in NAS backup, disaster recovery app

Critical bug in EoL D-Link NAS devices now exploited in attacks

D-Link won’t fix critical flaw affecting 60,000 older NAS devices

Synology hurries out patches for zero-days exploited at Pwn2Own