Skip to content
OpenAdvisories
High WID-SEC-2024-2077 8 CVEs

QNAP NAS QTS and QuTS hero: Mehrere Schwachstellen

Published Sep 8, 2024 · Updated Sep 8, 2024 · de-DE

Vendor: QNAP Systems Product: NAS

Summary

Ein Angreifer kann mehrere Schwachstellen in QNAP NAS ausnutzen, um beliebigen Programmcode auszuführen, Sicherheitsmaßnahmen zu umgehen und erweiterte Rechte zu erlangen.

Product

QNAP ist ein Hersteller von NAS (Network Attached Storage) Lösungen.

Vulnerabilities 8

  • High 8.8
    CVE-2023-34974

    QTS, QuTS hero, QuTScloud, QVR, QES

    An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow users to execute commands via a network. QuTScloud, QVR, QES are not affected. We have already fixed the vuln…

    QNAP Systems QTS QuTS hero QuTScloud
  • High 7.8
    CVE-2023-39298

    QTS, QuTS hero

    A missing authorization vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow local authenticated users to access data or perform actions that they should not be allowed to perform via un…

    QNAP Systems QTS QuTS hero QuTScloud
  • High 7.3
    CVE-2024-38641

    QTS, QuTS hero

    An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow local network users to execute commands via unspecified vectors. We have already fixed the vulnerability in t…

    QNAP Systems QTS QuTS hero
  • High 7.2
    CVE-2023-39300

    QTS

    An OS command injection vulnerability has been reported to affect legacy QTS. If exploited, the vulnerability could allow authenticated administrators to execute commands via a network. We have already fixed the vulnerability in the following versions: QTS 4.…

    QNAP Systems QTS QuTS hero QuTScloud
  • Medium 6.6
    CVE-2023-34979

    QTS, QuTS hero

    An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated administrators to execute commands via a network. We have already fixed the vulnerability in th…

    QNAP Systems QTS QuTS hero
  • Medium 5.3
    CVE-2024-32763

    QTS, QuTS hero

    A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated users to execute code via a network. We have already fixed the vulnerabili…

    QNAP Systems QTS QuTS hero
  • Medium 4.7
    CVE-2024-21906

    QTS, QuTS hero

    An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated administrators to execute commands via a network. We have already fixed the vulnerability in th…

    QNAP Systems QTS QuTS hero
  • Low 2.6
    CVE-2024-32771

    QTS, QuTS hero

    An improper restriction of excessive authentication attempts vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow local network authenticated administrators to perform an arbitrary numbe…

    QNAP Systems QTS QuTS hero QuTScloud

Revision history

  1. #1

    Initiale Fassung

References