CVE-2023-39296: QTS, QuTS hero

Published Jan 5, 2024

Updated

A prototype pollution vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow users to override existing attributes with ones that have incompatible type, which may lead to a crash via a network.

We have already fixed the vulnerability in the following versions: QTS 5.1.3.2578 build 20231110 and later QuTS hero h5.1.3.2578 build 20231110 and later

Affected Software

13 affected components

QNAP QTS=5.1.0.2348-build_20230325

QNAP QTS=5.1.0.2399-build_20230515

QNAP QTS=5.1.0.2418-build_20230603

QNAP QTS=5.1.0.2444-build_20230629

QNAP QTS=5.1.0.2466-build_20230721

QNAP QTS=5.1.1.2491-build_20230815

QNAP QTS=5.1.2.2533-build_20230926

QNAP QuTS hero=h5.1.0.2409-build_20230525

QNAP QuTS hero=h5.1.0.2424-build_20230609

QNAP QuTS hero=h5.1.0.2453-build_20230708

QNAP QuTS hero=h5.1.0.2466-build_20230721

QNAP QuTS hero=h5.1.1.2488-build_20230812

QNAP QuTS hero=h5.1.2.2534-build_20230927

Remediation

Information

We have already fixed the vulnerability in the following versions: QTS 5.1.3.2578 build 20231110 and later QuTS hero h5.1.3.2578 build 20231110 and later

Event History

Jan 5, 2024

CVE Published

via MITRE·04:19 PM

Data Sourced

via MITRE·04:19 PM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·05:15 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2023-39296?

CVE-2023-39296 is classified as a high severity prototype pollution vulnerability that can lead to system crashes.

Which QNAP software versions are affected by CVE-2023-39296?

CVE-2023-39296 affects several versions of QNAP's QTS and QuTS hero operating systems including 5.1.x builds and 5.1.0.x builds.

How do I fix CVE-2023-39296?

To fix CVE-2023-39296, users should update their QNAP systems to the latest available version provided by QNAP.

What can exploit CVE-2023-39296?

CVE-2023-39296 can be exploited through network vectors, allowing an attacker to manipulate system attributes.

What are the consequences of exploiting CVE-2023-39296?

Exploiting CVE-2023-39296 could lead to crashes of the affected QNAP devices and potential denial of service.