Security Alert (A24-02-02): Multiple Vulnerabilities in QNAP Products


 

Published on: 05 February 2024

  
  

Description:

QNAP has published security advisories to address multiple vulnerabilities in QNAP products. The list of patches can be found at:
https://www.qnap.com/en/security-advisory/qsa-23-30
https://www.qnap.com/en/security-advisory/qsa-23-33
https://www.qnap.com/en/security-advisory/qsa-23-38
https://www.qnap.com/en/security-advisory/qsa-23-46
https://www.qnap.com/en/security-advisory/qsa-23-47
https://www.qnap.com/en/security-advisory/qsa-23-53
https://www.qnap.com/en/security-advisory/qsa-24-01
https://www.qnap.com/en/security-advisory/qsa-24-02
https://www.qnap.com/en/security-advisory/qsa-24-04
https://www.qnap.com/en/security-advisory/qsa-24-05
https://www.qnap.com/en/security-advisory/qsa-24-07

 

Affected Systems:

  • QNAP NAS devices running QTS operating system versions prior to 4.5.4.2627 build 20231225, 5.1.5.2645 build 20240116
  • QNAP NAS devices running QuTS hero operating system versions prior to h4.5.4.2626 build 20231225, h5.1.5.2647 build 20240118
  • QNAP NAS devices running QuTScloud version prior to c5.1.5.2651

For detailed information of the affected systems, please refer to the corresponding security advisory at vendor's website.

 

Impact:

Successful exploitation of the vulnerabilities could lead to remote code execution, denial of service, information disclosure or security restriction bypass on an affected system.

 

Recommendation:

Patches for affected systems are available. System administrators of affected systems should follow the recommendations provided by the vendor and take immediate actions to mitigate the risk.

 

More Information:

  • https://www.qnap.com/en/security-advisory/qsa-23-30
  • https://www.qnap.com/en/security-advisory/qsa-23-33
  • https://www.qnap.com/en/security-advisory/qsa-23-38
  • https://www.qnap.com/en/security-advisory/qsa-23-46
  • https://www.qnap.com/en/security-advisory/qsa-23-47
  • https://www.qnap.com/en/security-advisory/qsa-23-53
  • https://www.qnap.com/en/security-advisory/qsa-24-01
  • https://www.qnap.com/en/security-advisory/qsa-24-02
  • https://www.qnap.com/en/security-advisory/qsa-24-04
  • https://www.qnap.com/en/security-advisory/qsa-24-05
  • https://www.qnap.com/en/security-advisory/qsa-24-07
  • https://www.hkcert.org/security-bulletin/qnap-nas-multiple-vulnerabilities_20240205
  • https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-32967
  • https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-39297
  • https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-39302 (to CVE-2023-39303)
  • https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-41273 (to CVE-2023-41283)
  • https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-41292
  • https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-45025 (to CVE-2023-45028)
  • https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-45035 (to CVE-2023-45037)
  • https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-47566 (to CVE-2023-47568)
  • https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-50359


Tag: NAS , QTS , QuTS hero , QuTScloud
Tags