QTS, QuTS hero, QuTScloud

Vulnerability

A buffer copy without checking size of input vulnerability exists in QNAP operating systems. This flaw affects QTS 5.1.x, QuTS hero h5.1.x, and QuTScloud c5.x. Authenticated administrators can trigger the vulnerability via network, possibly through crafted input that overflows a buffer [1]. The issue has been fixed in QTS 5.1.4.2596 build 20231128, QuTS hero h5.1.4.2596 build 20231128, and QuTScloud c5.1.5.2651 [1].

Exploitation

An attacker with existing administrative access (authenticated as admin) can exploit the vulnerability over the network by sending a specially crafted request that triggers an unchecked buffer copy operation. No user interaction beyond the attacker's own actions is required, though the attacker must be authenticated to the QNAP device [1].

Impact

Successful exploitation allows an authenticated administrator to execute arbitrary code on the affected device, leading to full compromise of the system. The attacker gains the ability to run commands or modify system files at the highest privilege level (root or admin equivalent) [1].

Mitigation

QNAP has released fixed versions: QTS 5.1.4.2596 build 20231128, QuTS hero h5.1.4.2596 build 20231128, and QuTScloud c5.1.5.2651. Users should update their systems to these or later versions via the Control Panel or QNAP Download Center [1]. No workaround is mentioned in the available references.