CVE-2023-32975: QTS, QuTS hero

Published Dec 8, 2023

Updated

A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated administrators to execute code via a network.

We have already fixed the vulnerability in the following versions: QTS 5.0.1.2514 build 20230906 and later QTS 5.1.2.2533 build 20230926 and later QuTS hero h5.0.1.2515 build 20230907 and later QuTS hero h5.1.2.2534 build 20230927 and later

Affected Software

31 affected components

QNAP QTS=5.1.0.2348-build_20230325

QNAP QTS=5.1.0.2399-build_20230515

QNAP QTS=5.1.0.2418-build_20230603

QNAP QTS=5.1.0.2444-build_20230629

QNAP QTS=5.1.0.2466-build_20230721

QNAP QTS=5.1.1.2491-build_20230815

QNAP QTS=5.0.1.2034-build_20220515

QNAP QTS=5.0.1.2079-build_20220629

QNAP QTS=5.0.1.2131-build_20220820

QNAP QTS=5.0.1.2137-build_20220826

QNAP QTS=5.0.1.2145-build_20220903

QNAP QTS=5.0.1.2173-build_20221001

QNAP QTS=5.0.1.2194-build_20221022

QNAP QTS=5.0.1.2234-build_20221201

QNAP QTS=5.0.1.2248-build_20221215

QNAP QTS=5.0.1.2277-build_20230112

QNAP QTS=5.0.1.2346-build_20230322

QNAP QTS=5.0.1.2376-build_20230421

QNAP QTS=5.0.1.2425-build_20230609

QNAP QuTS hero=h5.1.0.2409-build_20230525

QNAP QuTS hero=h5.1.0.2424-build_20230609

QNAP QuTS hero=h5.1.0.2453-build_20230708

QNAP QuTS hero=h5.1.0.2466-build_20230721

QNAP QuTS hero=h5.1.1.2488-build_20230812

QNAP QuTS hero=h5.0.1.2045-build_20220526

QNAP QuTS hero=h5.0.1.2192-build_20221020

QNAP QuTS hero=h5.0.1.2248-build_20221215

QNAP QuTS hero=h5.0.1.2269-build_20230104

QNAP QuTS hero=h5.0.1.2277-build_20230112

QNAP QuTS hero=h5.0.1.2348-build_20230324

QNAP QuTS hero=h5.0.1.2376-build_20230421

Remediation

Information

Event History

Dec 8, 2023

CVE Published

04:07 PM

Data Sourced

04:07 PM

RemedyDescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2023-32975?

CVE-2023-32975 has been classified as a high-severity vulnerability due to its potential for code execution by authenticated administrators.

How do I fix CVE-2023-32975?

To fix CVE-2023-32975, update your QNAP QTS or QuTS hero software to the latest patched version provided by QNAP.

What systems are affected by CVE-2023-32975?

CVE-2023-32975 affects multiple versions of QNAP QTS and QuTS hero operating systems, specifically versions from 5.0.1 up to 5.1.1.

Could CVE-2023-32975 be exploited remotely?

Yes, if exploited, CVE-2023-32975 allows authenticated administrators to execute code via the network.

Is user authentication required to exploit CVE-2023-32975?

Yes, exploitation of CVE-2023-32975 requires authenticated access by an administrator.