QTS, QuTS hero, QuTScloud
CVE-2023-45035

7.2HIGH

Key Information:

Vendor
QNAP
Vendor
CVE Published:
2 February 2024

Summary

A vulnerability affecting multiple QNAP operating system versions has been identified, characterized as a buffer copy without input size verification. This defect potentially grants authenticated administrators the ability to execute arbitrary code remotely over the network, creating significant security risks. Mitigating this issue involves updating to the latest versions of QTS, QuTS hero, or QuTScloud as mentioned in the vendor's advisory. Organizations utilizing affected versions are strongly advised to implement patches promptly to secure their systems.

Affected Version(s)

QTS 5.1.x < 5.1.4.2596 build 20231128

QuTS hero h5.1.x

QuTScloud c5.x.x

References

CVSS V3.1

Score:
7.2
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Jiaxu Zhao && Bingwei Peng
.