Security Alert (A24-04-20): Multiple Vulnerabilities in QNAP Products


 

Published on: 29 April 2024

  
  

Description:

QNAP has published security advisories to address multiple vulnerabilities in QNAP products. The list of patches can be found at:
https://www.qnap.com/en/security-advisory/qsa-24-14
https://www.qnap.com/en/security-advisory/qsa-24-15
https://www.qnap.com/en/security-advisory/qsa-24-16
https://www.qnap.com/en/security-advisory/qsa-24-17
https://www.qnap.com/en/security-advisory/qsa-24-18
https://www.qnap.com/en/security-advisory/qsa-24-20

 

Affected Systems:

  • QNAP NAS devices running QTS operating system versions prior to 4.5.4.2627 build 20231225, 5.1.3.2578 build 20231110, 5.1.4.2596 build 20231128, 5.1.6.2722 build 20240402
  • QNAP NAS devices running QuTS hero operating system versions prior to h4.5.4.2626 build 20231225, h5.1.3.2578 build 20231110, h5.1.6.2734 build 20240414
  • QNAP NAS devices running QuTScloud versions prior to c5.1.5.2651
  • QNAP NAS devices running QuFirewall versions prior to 2.4.1 (2024/02/01)
  • QNAP NAS devices running Proxy Server versions prior to 1.4.6 (2024/01/17)
  • QNAP NAS devices running Media Streaming add-on versions prior to 500.1.1.5 (2024/01/22)

For detailed information of the affected systems, please refer to the corresponding security advisory at vendor's website.

 

Impact:

Successful exploitation of the vulnerabilities could lead to remote code execution, information disclosure or security restriction bypass on an affected system.

 

Recommendation:

Patches for affected systems are available. System administrators of affected systems should follow the recommendations provided by the vendor and take immediate actions to mitigate the risk.

 

More Information:

  • https://www.qnap.com/en/security-advisory/qsa-24-14
  • https://www.qnap.com/en/security-advisory/qsa-24-15
  • https://www.qnap.com/en/security-advisory/qsa-24-16
  • https://www.qnap.com/en/security-advisory/qsa-24-17
  • https://www.qnap.com/en/security-advisory/qsa-24-18
  • https://www.qnap.com/en/security-advisory/qsa-24-20
  • https://www.hkcert.org/security-bulletin/qnap-nas-multiple-vulnerabilities_20240429
  • https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-5824
  • https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-41290 (to CVE-2023-41291)
  • https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-46724
  • https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-46846 (to CVE-2023-46847)
  • https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-47222
  • https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-50361 (to CVE-2023-50364)
  • https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-51364 (to CVE-2023-51365)
  • https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21905


Tag: NAS , QTS , QuTS hero , QuTScloud , QuFirewall , Proxy Server , Media Streaming
Tags