QTS, QuTS hero, QuTScloud
CVE-2023-45035
7.2HIGH
Summary
A vulnerability affecting multiple QNAP operating system versions has been identified, characterized as a buffer copy without input size verification. This defect potentially grants authenticated administrators the ability to execute arbitrary code remotely over the network, creating significant security risks. Mitigating this issue involves updating to the latest versions of QTS, QuTS hero, or QuTScloud as mentioned in the vendor's advisory. Organizations utilizing affected versions are strongly advised to implement patches promptly to secure their systems.
Affected Version(s)
QTS 5.1.x < 5.1.4.2596 build 20231128
QuTS hero h5.1.x
QuTScloud c5.x.x
References
CVSS V3.1
Score:
7.2
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged
Timeline
Vulnerability published
Vulnerability Reserved
Credit
Jiaxu Zhao && Bingwei Peng