QTS, QuTS hero, QuTScloud

Vulnerability

A buffer copy without checking size of input vulnerability exists in QNAP QTS, QuTS hero, and QuTScloud operating systems. Affected versions include QTS 5.1.x, QuTS hero h5.1.x, and QuTScloud 5.x. The vulnerability is exploitable by authenticated administrators via network [1].

Exploitation

An authenticated administrator can send a specially crafted network request to trigger the buffer copy without proper size validation, leading to code execution. No additional user interaction or privileges beyond administrative access are required [1].

Impact

Successful exploitation allows an authenticated administrator to execute arbitrary code on the affected QNAP device. This can result in full compromise of the NAS, including data access, modification, and potential lateral movement within the network [1].

Mitigation

QNAP has fixed the vulnerability in the following versions: QTS 5.1.4.2596 build 20231128 and later, QuTS hero h5.1.4.2596 build 20231128 and later, and QuTScloud c5.1.5.2651 and later. Users should update their systems to these or later versions. No workarounds are provided; regular updates are recommended [1].