Skip to content
OpenAdvisories
High · 8.7 Public exploit CVE-2024-53691 EUVD-2024-52034GHSA-6hfr-hxpf-c7m6

QTS, QuTS hero

Published Dec 6, 2024 · Updated Nov 4, 2026 · Assigned by qnap

Vendor: QNAP Systems Product: QTS Product: QuTS hero

Description

A link following vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote attackers who have gained user access to traverse the file system to unintended locations.

We have already fixed the vulnerability in the following versions:
QTS 5.1.8.2823 build 20240712 and later
QTS 5.2.0.2802 build 20240620 and later
QuTS hero h5.1.8.2823 build 20240712 and later
QuTS hero h5.2.0.2802 build 20240620 and later

Affected products

VendorProductAffectedFixed
QNAP Systems QTS 5.1.x – < 5.1.8.2823 build 20240712, 5.2.x – < 5.2.0.2802 build 20240620 5.1.8.2823 build 20240712
QNAP Systems QuTS hero h5.1.x – < h5.1.8.2823 build 20240712, h5.2.x – < h5.2.0.2802 build 20240620 h5.1.8.2823 build 20240712

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 1 repository

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

References