QTS, QuTS hero, QuTScloud

Vulnerability

A buffer copy without checking size of input vulnerability exists in QNAP QTS 5.1.x, QuTS hero h5.1.x, and QuTScloud 5.x. The flaw resides in an unspecified component that fails to validate the size of input before copying into a buffer. Affected versions include QTS 5.1.x prior to 5.1.2.2533 build 20230926, QuTS hero h5.1.x prior to h5.1.2.2534 build 20230927, and QuTScloud c5.x prior to c5.1.5.2651 [1].

Exploitation

An attacker must be an authenticated administrator with network access to the QNAP device. The vulnerability can be exploited remotely without user interaction. The exact steps are not detailed in the advisory, but the buffer copy flaw can be triggered by sending a crafted request to the vulnerable service [1].

Impact

Successful exploitation allows the authenticated administrator to execute arbitrary code on the device, potentially leading to full compromise of the NAS system. The attacker gains code execution at the privilege level of the affected process, which is likely root or system-level [1].

Mitigation

QNAP has fixed the vulnerability in QTS 5.1.2.2533 build 20230926 and later, QuTS hero h5.1.2.2534 build 20230927 and later, and QuTScloud c5.1.5.2651 and later. Users should update to these versions or later. No workarounds are provided. The advisory was released on February 3, 2024 [1].