CVE-2023-32967: QTS, QuTScloud

Published Feb 2, 2024

Updated

An incorrect authorization vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated users to bypass intended access restrictions via a network. QTS 5.x, QuTS hero are not affected.

We have already fixed the vulnerability in the following versions: QuTScloud c5.1.5.2651 and later QTS 4.5.4.2627 build 20231225 and later

Affected Software

13 affected components

QNAP QTS=4.5.4.1715-build_20210630

QNAP QTS=4.5.4.1723-build_20210708

QNAP QTS=4.5.4.1741-build_20210726

QNAP QTS=4.5.4.1787-build_20210910

QNAP QTS=4.5.4.1800-build_20210923

QNAP QTS=4.5.4.1892-build_20211223

QNAP QTS=4.5.4.1931-build_20220128

QNAP QTS=4.5.4.2012-build_20220419

QNAP QTS=4.5.4.2117-build_20220802

QNAP QTS=4.5.4.2280-build_20230112

QNAP QTS=4.5.4.2374-build_20230416

QNAP QTS=4.5.4.2627

QNAP QuTScloud=c5.1.0.2498-build_20230822

Remediation

Information

We have already fixed the vulnerability in the following versions: QuTScloud c5.1.5.2651 and later QTS 4.5.4.2627 build 20231225 and later

Event History

Feb 2, 2024

CVE Published

via MITRE·04:02 PM

Data Sourced

via MITRE·04:02 PM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·04:15 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2023-32967?

CVE-2023-32967 has been identified as an incorrect authorization vulnerability that may allow authenticated users to bypass access restrictions.

How do I fix CVE-2023-32967?

To fix CVE-2023-32967, users should update their QNAP QTS software to the latest version that includes security patches.

Which QNAP versions are affected by CVE-2023-32967?

CVE-2023-32967 affects several QNAP QTS versions, including 4.5.4.1715 to 4.5.4.2374, but not QTS 5.x or QuTS hero.

Can CVE-2023-32967 be exploited remotely?

Yes, CVE-2023-32967 can potentially be exploited via a network by authenticated users.

Is there a workaround for CVE-2023-32967?

There is no specific workaround for CVE-2023-32967, but upgrading to the latest software version is recommended to mitigate the risk.