QTS, QuTS hero, QuTScloud

Vulnerability

A buffer copy without checking size of input vulnerability exists in QNAP QTS 5.1.x, QuTS hero h5.1.x, and QuTScloud 5.x. Affected versions are those prior to QTS 5.1.4.2596 build 20231128, QuTS hero h5.1.4.2596 build 20231128, and QuTScloud c5.1.5.2651. The vulnerability can be triggered by authenticated administrators via network requests, leading to a buffer overflow condition [1].

Exploitation

An attacker must be an authenticated administrator on the QNAP device. No additional user interaction is required beyond authentication. The attack vector is network-based; the exact sequence of steps is not publicly detailed, but the buffer copy operation without proper size validation can be exploited by sending crafted network requests [1].

Impact

Successful exploitation allows the attacker to execute arbitrary code on the device with administrative privileges. This results in full compromise of the confidentiality, integrity, and availability of the NAS system [1].

Mitigation

QNAP has fixed the vulnerability in QTS 5.1.4.2596 build 20231128 and later, QuTS hero h5.1.4.2596 build 20231128 and later, and QuTScloud c5.1.5.2651 and later. Users should update their systems via Control Panel > Firmware Update or by downloading the update from the QNAP website. No workarounds are provided, and the vulnerability is not listed on the CISA Known Exploited Vulnerabilities catalog as of the advisory release date [1].