Skip to content
OpenAdvisories
High NCSC-2024-0230 5 CVEs

Kwetsbaarheden verholpen in QNAP QTS en QTS Hero

Published May 22, 2024 · Updated May 22, 2024 · nl

Vendor: QNAP Systems Product: QTS

Summary

QNAP heeft kwetsbaarheden verholpen in QTS en QTS Hero.

Details

Interpretaties
Een kwaadwillende kan de kwetsbaarheden misbruiken om willekeurige code uit te voeren op het kwetsbare systeem.

Voor succesvol misbruik moet de kwaadwillende geautoriseerd zijn.

Oplossingen
QNAP heeft updates uitgebracht om de kwetsbaarheden te verhelpen in QTS en QTS Hero 5.1.7.2770. Zie bijgevoegde referenties voor meer informatie:

https://www.qnap.com/en/security-advisory/qsa-24-23

Vulnerabilities 5

  • High 7.2
    CVE-2024-27127

    QTS, QuTS hero

    A double free vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated users to execute arbitrary code via a network. We have already fixed the vulnerability in the following v…

    QNAP Systems QTS QuTS hero
  • High 7.2
    CVE-2024-27130 Public exploit EPSS 38%

    QTS, QuTS hero

    A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow users to execute code via a network. We have already fixed the vulnerability in the foll…

    QNAP Systems QTS QuTS hero
  • Medium 6.4
    CVE-2024-21902

    QTS, QuTS hero

    An incorrect permission assignment for critical resource vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated users to read or modify the resource via a network. We have al…

    QNAP Systems QTS QuTS hero
  • Medium 6.4
    CVE-2024-27128

    QTS, QuTS hero

    A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated users to execute code via a network. We have already fixed the vulnerabili…

    QNAP Systems QTS QuTS hero
  • Medium 6.4
    CVE-2024-27129

    QTS, QuTS hero

    A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated users to execute code via a network. We have already fixed the vulnerabili…

    QNAP Systems QTS QuTS hero

Revision history

  1. #0

    Initiele versie

References