CVE-2023-41275 - QTS, QuTS hero, QuTScloud

Back Back to CVE browser

HIGH

QTS, QuTS hero, QuTScloud

Published Feb 2, 2024

7.2

HIGH

CVSS 3.1

EPSS 0.55%

Description

A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated administrators to execute code via a network.

We have already fixed the vulnerability in the following versions: QTS 5.1.2.2533 build 20230926 and later QuTS hero h5.1.2.2534 build 20230927 and later QuTScloud c5.1.5.2651 and later

Affected products

Vendor QNAP Systems Inc. Product QTS Default
unaffected
Affected
- ≥ 5.1.x, < 5.1.2.2533 build 20230926
Vendor QNAP Systems Inc. Product QuTS hero Default
unaffected
Affected
- ≥ h5.1.x, < h5.1.2.2534 build 20230927
Vendor QNAP Systems Inc. Product QuTScloud Default
unaffected
Affected
- ≥ c5.x.x, < c5.1.5.2651

Default status is the baseline for the product. Each version can override it (patched versions can be marked unaffected).

Vendor	Product	Default status	Versions
QNAP Systems Inc.	QTS	unaffected	Affected ≥ 5.1.x, < 5.1.2.2533 build 20230926
QNAP Systems Inc.	QuTS hero	unaffected	Affected ≥ h5.1.x, < h5.1.2.2534 build 20230927
QNAP Systems Inc.	QuTScloud	unaffected	Affected ≥ c5.x.x, < c5.1.5.2651

Remediation

Vendor solution

We have already fixed the vulnerability in the following versions: QTS 5.1.2.2533 build 20230926 and later QuTS hero h5.1.2.2534 build 20230927 and later QuTScloud c5.1.5.2651 and later

Weaknesses (2)

CWE-120

Classic Buffer Overflow

CWE-122