The Zero Day Initiative has published ZDI-26-776, disclosing an unauthenticated format string vulnerability in the syslog message-handling path of QNAP TS-453E network-attached storage devices. A network-adjacent attacker — anyone who can reach the device's syslog listener — can leverage this flaw to execute arbitrary code without credentials. ZDI assigns the issue a CVSS base score of 7.5 (High), and the advisory is tracked against CVE-2018-10388 and CVE-2018-10389, identifiers reflecting the long and troubled history of format string handling in embedded syslog daemons.
Let me be blunt about why this matters in 2026: QNAP devices remain one of the most consistently targeted asset classes on the internet. Ransomware crews, cryptominers, and initial access brokers have built entire pipelines around NAS exploitation because these boxes hold crown-jewel data — backups, file shares, surveillance footage — and they are almost never monitored with the same rigor as servers or endpoints. An unauthenticated code execution path reachable via a service as mundane as syslog is exactly the kind of primitive that gets folded into automated exploitation tooling within weeks of disclosure. If you operate TS-453E units — or any QNAP fleet with a syslog receiver enabled — treat this as an active remediation priority, not a backlog item.
Technical Analysis
Affected Products and Component
Per the ZDI advisory, the flaw resides in the handling of the log_message function within the syslog processing component on QNAP TS-453E devices. The TS-453E is an Intel Celeron-based 4-bay NAS running QTS, QNAP's Linux-derived operating system. QTS ships with an optional syslog server capability (inbound log reception, typically on UDP/TCP 514) that administrators enable to centralize logs from other network devices.
Vulnerability Class: Format String Injection
This is a classic CWE-134: Use of Externally-Controlled Format String. The defect pattern is well understood:
- The syslog daemon receives a log message from a remote sender.
- The attacker-controlled message body is passed — directly or transitively — as the format string argument to a
printf-family function (e.g.,syslog(priority, msg)orfprintf(fp, msg)instead of the safefprintf(fp, "%s", msg)). - By embedding format specifiers such as
%x,%s, and critically%nin the message payload, the attacker gains the ability to read stack memory, leak pointers, and write arbitrary values to arbitrary memory addresses.
The %n specifier is what elevates this from an information leak to code execution: %n writes the number of bytes printed so far into a pointer pulled from the argument stack. With careful payload construction — and on an embedded x86-64 target with predictable memory layout, this is very achievable — an attacker can overwrite a function pointer, a GOT entry, or a return address and redirect execution into attacker-controlled or staged code.
Exploitation Requirements and Constraints
- Authentication: None required. This is a pre-auth remote trigger.
- Positioning: Network-adjacent (AV:A in CVSS terms). The attacker must be able to deliver syslog packets to the device — same broadcast domain, routed internal network, or any network where the syslog port is exposed. Note that QNAP devices with misconfigured port forwarding or direct WAN exposure collapse the "adjacent" requirement entirely; UDP 514 is spoofable and stateless.
- Complexity: Format string exploitation against modern glibc with
_FORTIFY_SOURCEand%n-in-writable-memory hardening raises the bar, which likely contributes to the 7.5 (rather than 9.x) score. Do not let that lull you — dedicated exploit development against a fixed embedded target is a matter of time, not possibility.
Exploitation Status
As of this writing, ZDI-26-776 is a published advisory with a coordinated disclosure history; there is no confirmed mass in-the-wild exploitation and it does not yet appear in CISA's Known Exploited Vulnerabilities catalog. However, ZDI publication means technical details are now public, and QNAP's exploitation track record (DeadBolt, eCh0raix, Qlocker campaigns) tells us exactly how fast NAS advisories get weaponized. Treat "no known exploitation" as a temporary condition.
Detection & Response
Detection on NAS devices is hard because most organizations ship zero telemetry off them. The defenses below assume you are forwarding QNAP syslogs (ironic but necessary) to a SIEM, and/or monitoring network traffic to port 514. Every rule here targets observable, low-noise behavior.
---
title: Syslog Daemon Spawning Shell or Command Interpreter on Linux/NAS
id: 3f8c2a41-7b1d-4e59-9c06-8d2e5f7a1b34
status: experimental
description: Detects a shell or command interpreter spawned as a child of a syslog process (syslogd, rsyslogd, syslog-ng). A successful format string exploit against the syslog handler will typically result in the daemon process executing attacker commands, making anomalous child processes the highest-fidelity post-exploitation signal on QTS and embedded Linux systems.
references:
- http://www.zerodayinitiative.com/advisories/ZDI-26-776/
- https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/04/06
tags:
- attack.execution
- attack.t1059.004
logsource:
category: process_creation
product: linux
detection:
selection_parent:
ParentImage|endswith:
- '/syslogd'
- '/rsyslogd'
- '/syslog-ng'
- '/syslogd.cgi'
selection_child:
Image|endswith:
- '/sh'
- '/bash'
- '/dash'
- '/ash'
- '/python'
- '/python3'
- '/perl'
- '/wget'
- '/curl'
- '/nc'
- '/ncat'
- '/busybox'
condition: selection_parent and selection_child
falsepositives:
- Extremely rare; legitimate syslog daemons do not spawn shells. rsyslog omprog output modules can execute configured programs — validate against known configuration.
level: critical
---
title: Syslog Message Containing Format String Exploitation Specifiers
id: 9b1e6d02-4c7a-4f38-a521-6e3c9d1f5a78
status: experimental
description: Detects inbound or forwarded syslog messages containing dense sequences of printf-style format specifiers (%n, %x, %s, %p) characteristic of format string exploitation or reconnaissance probes. Legitimate log content almost never contains repeated %n tokens, which are only useful for memory-write primitives.
references:
- http://www.zerodayinitiative.com/advisories/ZDI-26-776/
- https://cwe.mitre.org/data/definitions/134.html
author: Security Arsenal
date: 2026/04/06
tags:
- attack.initial_access
- attack.t1190
logsource:
product: linux
service: syslog
detection:
selection:
Message|contains:
- '%n%n%n'
- '%n.%n.'
- '%x%x%x%x'
- '%08x.%08x'
- 'AAAA%'
- '%s%s%s%s%s'
- '%p%p%p%p'
condition: selection
falsepositives:
- Developer test logging with format strings; fuzzing/QA infrastructure. Tune by source host in environments with active application security testing.
level: high
---
title: New or Unexpected UDP/TCP 514 Connections to NAS Syslog Listener
id: 5c4d7f19-2e8b-4a63-b710-1f9a3e6c2d45
status: experimental
description: Detects network connections to syslog port 514 from sources not in the approved log-forwarder inventory. Unauthenticated syslog RCE requires packet delivery to the listener, so any non-baseline source talking to 514 on a storage asset warrants investigation. Deploy as an allowlist-complement rule in environments where syslog sources are enumerable.
references:
- http://www.zerodayinitiative.com/advisories/ZDI-26-776/
author: Security Arsenal
date: 2026/04/06
tags:
- attack.initial_access
- attack.t1190
logsource:
category: network_connection
detection:
selection:
DestinationPort: 514
filter_known_forwarders:
SourceIp:
- '10.0.0.0/8'
condition: selection and not filter_known_forwarders
falsepositives:
- Newly deployed log forwarders not yet added to the allowlist; vulnerability scanners (expected and benign — verify against scan schedules).
level: medium
// Hunt: Syslog messages containing format string exploitation patterns
// Assumes QNAP/NAS syslog is forwarded to Sentinel via CEF or Syslog collector
union Syslog, CommonSecurityLog
| where TimeGenerated > ago(7d)
| extend MessageText = column_ifexists("SyslogMessage", column_ifexists("Message", ""))
| where MessageText has_any ("%n", "%08x", "%p%p", "AAAA%")
or MessageText matches regex @"(%[xsn]){4,}"
| summarize FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated), MessageCount = count(),
SampleMessages = make_set(MessageText, 5)
by Computer, SourceIP = column_ifexists("SourceIP", HostIP), ProcessName
| order by MessageCount desc
// Hunt: Anomalous traffic volume or new sources targeting UDP/TCP 514 on storage assets
CommonSecurityLog
| where TimeGenerated > ago(14d)
| where DestinationPort == 514
| where DeviceAction !in ("deny", "blocked", "drop")
| summarize Connections = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated),
UniqueDestinations = dcount(DestinationIP)
by SourceIP, DestinationIP, DestinationPort, Protocol = column_ifexists("Protocol", "")
| where Connections > 500 or FirstSeen > ago(1d)
| order by Connections desc
-- Hunt on a QNAP/Linux endpoint: shells or interpreters spawned by syslog daemons
-- Deploy via a Velociraptor Linux client on QTS where architecture permits,
-- or against a mounted/acquired QTS filesystem image.
SELECT Pid, Ppid, Name, CommandLine, Exe, Username, CreateTime,
parent.Name AS ParentName, parent.Exe AS ParentExe
FROM pslist()
LET parent = SELECT Name, Exe, Pid FROM pslist()
WHERE (ParentExe =~ '(syslogd|rsyslogd|syslog-ng|syslogd.cgi)$'
OR ParentName =~ '(syslogd|rsyslogd|syslog-ng)')
AND (Exe =~ '(sh|bash|ash|dash|busybox|python|perl|nc|wget|curl)$'
OR CommandLine =~ '(/tmp/|/dev/shm/|wget |curl |chmod \+x)')
#!/bin/bash
# ZDI-26-776 — QNAP TS-453E syslog format string RCE
# Hardening and exposure-verification script (run on the QNAP shell via SSH as admin)
echo "=== [1] Firmware / QTS version check ==="
/sbin/getcfg System "Build Number" 2>/dev/null
/sbin/getcfg System Version 2>/dev/null
echo "Compare against the fixed build listed in the QNAP security advisory for ZDI-26-776."
echo ""
echo "=== [2] Is the syslog server (inbound log reception) enabled? ==="
SYSLOG_RECV=$(/sbin/getcfg SYSLOG "Server Enable" -d "0" 2>/dev/null)
echo "Syslog Server Enable = $SYSLOG_RECV"
if [ "$SYSLOG_RECV" = "1" ]; then
echo "[!] RISK: Inbound syslog reception is ENABLED. Disable it unless required:"
echo " Control Panel > System > Syslog > uncheck 'Enable Syslog Server'"
echo " Or via CLI: /sbin/setcfg SYSLOG \"Server Enable\" 0"
fi
echo ""
echo "=== [3] Listeners on port 514 (UDP/TCP) ==="
netstat -tunlp 2>/dev/null | grep ':514' || echo "No listeners on 514 — good."
echo ""
echo "=== [4] Restrict inbound 514 to approved log forwarders only (iptables) ==="
echo "Adjust ALLOWED_FWD to your SIEM/collector IPs before uncommenting."
# ALLOWED_FWD="10.10.20.15 10.10.20.16"
# for ip in $ALLOWED_FWD; do
# iptables -I INPUT -p udp -s $ip --dport 514 -j ACCEPT
# iptables -I INPUT -p tcp -s $ip --dport 514 -j ACCEPT
# done
# iptables -A INPUT -p udp --dport 514 -j DROP
# iptables -A INPUT -p tcp --dport 514 -j DROP
echo ""
echo "=== [5] Check syslog daemon for anomalous child processes (live triage) ==="
for pid in $(pgrep -f 'syslogd|rsyslogd|syslog-ng'); do
children=$(pgrep -P $pid)
if [ -n "$children" ]; then
echo "[!] Syslog PID $pid has children — investigate:"
ps -o pid,ppid,user,comm,args -p $children
fi
done
echo "Triage complete."
Remediation
- Apply the QNAP firmware update immediately. Consult the QNAP Product Security Status page (https://www.qnap.com/en/security-advisories) for the QTS build that resolves ZDI-26-776 / CVE-2018-10388 / CVE-2018-10389 on the TS-453E, and patch to that build or later. Given the pre-auth nature of this flaw, this should be scheduled inside your emergency change window, not the next quarterly cycle.
- Disable inbound syslog reception if you don't need it. The attack surface only exists when the device is acting as a syslog server. Most deployments enable this once for a project and forget it. Control Panel → System → Syslog → uncheck the syslog server option, or use the
setcfgcommand in the script above. - Enforce source allowlisting on port 514. If the syslog receiver must stay enabled, restrict UDP/TCP 514 to the enumerated set of devices that legitimately forward logs. Do this at the switch ACL or firewall layer — not just on the box — so the control survives QTS configuration drift and persists across reboots (QNAP iptables rules are notoriously non-persistent).
- Never expose port 514 (or any QTS service) to the internet. Audit NAT/port-forwarding rules on perimeter devices for any mapping to NAS assets. UDP 514 is stateless and source-address-spoofable; adjacency constraints are your minimum defense, not your strategy.
- Ship NAS logs to your SIEM. Forward QTS system and access logs outbound to your collector, then deploy the Sigma and KQL content above. A NAS with no telemetry is a ransomware staging ground you cannot see.
- Segment storage infrastructure. NAS devices belong on a dedicated VLAN with no inbound connectivity from user workstations beyond the required file-sharing protocols. Network adjacency is the only thing standing between "network-adjacent attacker" and "domain-joined workstation that got phished."
- Hunt retroactively. Pull 30+ days of firewall/NetFlow data for port 514 connections to QNAP assets from non-forwarder sources. Pre-auth bugs with public advisories frequently have quiet pre-disclosure exploitation from the original reporter's counterparty or from researchers who fuzzed the same code path independently.
Related Resources
Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub
Is your security operations ready?
Get a free SOC assessment or see how AlertMonitor cuts through alert noise with automated triage.