A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated administrators to execute code via a network.
We have already fixed the vulnerability in the following versions:
QTS 5.1.4.2596 build 20231128 and later
QuTS hero h5.1.4.2596 build 20231128 and later
References
| Link | Resource |
|---|---|
| https://www.qnap.com/en/security-advisory/qsa-23-27 | Vendor Advisory |
| https://www.qnap.com/en/security-advisory/qsa-23-27 | Vendor Advisory |
Configurations
Configuration 1 (hide)
|
Configuration 2 (hide)
|
History
21 Nov 2024, 08:26
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://www.qnap.com/en/security-advisory/qsa-23-27 - Vendor Advisory | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 3.8 |
10 Jan 2024, 16:57
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://www.qnap.com/en/security-advisory/qsa-23-27 - Vendor Advisory | |
| First Time |
Qnap quts Hero
Qnap qts Qnap |
|
| CPE | cpe:2.3:o:qnap:qts:5.1.1.2491:build_20230815:*:*:*:*:*:* cpe:2.3:o:qnap:quts_hero:h5.1.0.2424:build_20230609:*:*:*:*:*:* cpe:2.3:o:qnap:qts:5.1.0.2466:build_20230721:*:*:*:*:*:* cpe:2.3:o:qnap:qts:5.1.2.2533:build_20230926:*:*:*:*:*:* cpe:2.3:o:qnap:quts_hero:h5.1.2.2534:build_20230927:*:*:*:*:*:* cpe:2.3:o:qnap:quts_hero:h5.1.0.2453:build_20230708:*:*:*:*:*:* cpe:2.3:o:qnap:quts_hero:h5.1.3.2578:build_20231110:*:*:*:*:*:* cpe:2.3:o:qnap:qts:5.1.0.2418:build_20230603:*:*:*:*:*:* cpe:2.3:o:qnap:qts:5.1.3.2578:build_20231110:*:*:*:*:*:* cpe:2.3:o:qnap:qts:5.1.0.2444:build_20230629:*:*:*:*:*:* cpe:2.3:o:qnap:quts_hero:h5.1.0.2466:build_20230721:*:*:*:*:*:* cpe:2.3:o:qnap:quts_hero:h5.1.0.2409:build_20230525:*:*:*:*:*:* cpe:2.3:o:qnap:qts:5.1.0.2348:build_20230325:*:*:*:*:*:* cpe:2.3:o:qnap:quts_hero:h5.1.1.2488:build_20230812:*:*:*:*:*:* cpe:2.3:o:qnap:qts:5.1.0.2399:build_20230515:*:*:*:*:*:* |
|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 7.2 |
05 Jan 2024, 18:23
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2024-01-05 17:15
Updated : 2024-11-21 08:26
NVD link : CVE-2023-45041
Mitre link : CVE-2023-45041
CVE.ORG link : CVE-2023-45041
JSON object : View
Products Affected
qnap
- qts
- quts_hero
CWE
CWE-120
Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')