QTS, QuTS hero, QuTScloud

Vulnerability

A buffer copy without checking size of input vulnerability exists in QNAP QTS 5.1.x, QuTS hero h5.1.x, and QuTScloud 5.x. The flaw resides in an unspecified component that processes network requests. An authenticated administrator can trigger the vulnerability by sending a crafted request that causes a buffer overflow. Affected versions include QTS 5.1.x prior to 5.1.2.2533 build 20230926, QuTS hero h5.1.x prior to h5.1.2.2534 build 20230927, and QuTScloud c5.x prior to c5.1.5.2651 [1].

Exploitation

An attacker must have network access to the QNAP device and valid administrative credentials. The attacker sends a specially crafted network request that exploits the buffer copy without size check, leading to memory corruption. No user interaction beyond the authenticated session is required [1].

Impact

Successful exploitation allows the authenticated administrator to execute arbitrary code on the affected device. This can lead to full compromise of the system, including data exfiltration, installation of malware, or further lateral movement within the network [1].

Mitigation

QNAP has fixed the vulnerability in the following versions: QTS 5.1.2.2533 build 20230926 and later, QuTS hero h5.1.2.2534 build 20230927 and later, and QuTScloud c5.1.5.2651 and later. Users should update their systems to these or newer builds. No workarounds are provided in the advisory. The vulnerability is not listed on the CISA Known Exploited Vulnerabilities (KEV) catalog as of the publication date [1].