Skip to content
OpenAdvisories
High NCSC-2024-0361 7 CVEs

Kwetsbaarheden verholpen in QNAP QTS en QTS Hero

Published Sep 10, 2024 · Updated Sep 10, 2024 · nl

Vendor: QNAP Systems Product: QTS Product: QuTS hero

Summary

QNAP heeft kwetsbaarheden verholpen in QTS en QTS Hero.

Details

Interpretaties
Een kwaadwillende kan de kwetsbaarheden misbruiken om zich verhoogde rechten toe te kennen, toegang te krijgen tot gevoelige gegevens of willekeurige OS commando's uit te voeren.

Voor succesvol misbruik moet de kwaadwillende reeds over voorafgaande authenticatie beschikken.

Oplossingen
QNAP heeft updates uitgebracht om de kwetsbaarheden te verhelpen. Zie bijgevoegde referenties voor meer informatie.

Vulnerabilities 7

  • High 8.8
    CVE-2023-34974

    QTS, QuTS hero, QuTScloud, QVR, QES

    An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow users to execute commands via a network. QuTScloud, QVR, QES are not affected. We have already fixed the vuln…

    QNAP Systems QTS QuTS hero QuTScloud
  • High 7.8
    CVE-2023-39298

    QTS, QuTS hero

    A missing authorization vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow local authenticated users to access data or perform actions that they should not be allowed to perform via un…

    QNAP Systems QTS QuTS hero QuTScloud
  • High 7.3
    CVE-2024-38641

    QTS, QuTS hero

    An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow local network users to execute commands via unspecified vectors. We have already fixed the vulnerability in t…

    QNAP Systems QTS QuTS hero
  • Medium 6.6
    CVE-2023-34979

    QTS, QuTS hero

    An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated administrators to execute commands via a network. We have already fixed the vulnerability in th…

    QNAP Systems QTS QuTS hero
  • Medium 5.3
    CVE-2024-32763

    QTS, QuTS hero

    A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated users to execute code via a network. We have already fixed the vulnerabili…

    QNAP Systems QTS QuTS hero
  • Medium 4.7
    CVE-2024-21906

    QTS, QuTS hero

    An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated administrators to execute commands via a network. We have already fixed the vulnerability in th…

    QNAP Systems QTS QuTS hero
  • Low 2.6
    CVE-2024-32771

    QTS, QuTS hero

    An improper restriction of excessive authentication attempts vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow local network authenticated administrators to perform an arbitrary numbe…

    QNAP Systems QTS QuTS hero QuTScloud

Revision history

  1. #0

    Initiele versie

References