{"cve":"CVE-2009-3200","nvd":{"published":"2009-09-21T19:30:00.420","modified":"2026-06-16T23:11:07.573","status":"Modified","description":"The QNAP TS-239 Pro and TS-639 Pro with firmware 2.1.7 0613, 3.1.0 0627, and 3.1.1 0815 create an undocumented recovery key and store it in the ENCK variable in flash memory, which allows local users to bypass the passphrase requirement and decrypt the hard drive by reading this variable, deobfuscating the key, and running a cryptsetup luksOpen command.","cvss_v4":null,"cvss_v3":null,"cwes":["CWE-310"],"references":["http://forum.qnap.com/viewtopic.php?f=11&t=11214&start=20#p63346","http://forum.qnap.com/viewtopic.php?f=12&t=12104&start=10#p63341","http://secunia.com/advisories/36793","http://www.baseline-security.de/downloads/BSC-Qnap_Crypto_Backdoor-CVE-2009-3200.txt","http://www.securityfocus.com/archive/1/506607/100/0/threaded"],"products":["qnap:ts-239_pro_turbo_nas","qnap:ts-639_pro_turbo_nas"],"source":"nvd","synced_at":"2026-10-19T19:54:26.868835795+00:00"},"epss":{"cve":"CVE-2009-3200","score":0.00404,"percentile":0.34706,"date":"2026-10-31"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}