QTS, QuTS hero, QuTScloud
CVE-2023-45036
7.2HIGH
Summary
A vulnerability has been identified in several versions of the QNAP operating system, characterized by a buffer copy operation that does not adequately validate the size of the input. This oversight may be exploited by authenticated administrators to execute arbitrary code through a network interface. It represents a serious risk to system integrity and emphasizes the necessity of regular software updates to mitigate potential threats. The issue has been addressed in the latest software versions, underscoring the critical importance of maintaining up-to-date systems.
Affected Version(s)
QTS 5.1.x < 5.1.3.2578 build 20231110
QuTS hero h5.1.x
QuTScloud c5.x.x
References
CVSS V3.1
Score:
7.2
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged
Timeline
Vulnerability published
Vulnerability Reserved
Credit
Jiaxu Zhao && Bingwei Peng