CVE-2023-39303: QTS, QuTS hero, QuTScloud

Published Feb 2, 2024

Updated

An improper authentication vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow users to compromise the security of the system via a network.

We have already fixed the vulnerability in the following versions: QTS 5.1.3.2578 build 20231110 and later QuTS hero h5.1.3.2578 build 20231110 and later QuTScloud c5.1.5.2651 and later

Affected Software

16 affected components

QNAP QTS=5.1.0.2348-build_20230325

QNAP QTS=5.1.0.2399-build_20230515

QNAP QTS=5.1.0.2418-build_20230603

QNAP QTS=5.1.0.2444-build_20230629

QNAP QTS=5.1.0.2466-build_20230721

QNAP QTS=5.1.1.2491-build_20230815

QNAP QTS=5.1.2.2533-build_20230926

QNAP QTS=5.1.3.2578

QNAP QuTS hero=h5.1.0.2409-build_20230525

QNAP QuTS hero=h5.1.0.2424-build_20230609

QNAP QuTS hero=h5.1.0.2453-build_20230708

QNAP QuTS hero=h5.1.0.2466-build_20230721

QNAP QuTS hero=h5.1.1.2488-build_20230812

QNAP QuTS hero=h5.1.2.2534-build_20230927

QNAP QuTS hero=h5.1.3.2578

QNAP QuTScloud=c5.1.0.2498-build_20230822

Remediation

Information

We have already fixed the vulnerability in the following versions: QTS 5.1.3.2578 build 20231110 and later QuTS hero h5.1.3.2578 build 20231110 and later QuTScloud c5.1.5.2651 and later

Event History

Feb 2, 2024

CVE Published

via MITRE·04:03 PM

Data Sourced

via MITRE·04:03 PM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·04:15 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2023-39303?

CVE-2023-39303 has been classified as a critical vulnerability due to its impact on authentication security.

How do I fix CVE-2023-39303?

You can mitigate CVE-2023-39303 by upgrading to the latest version of QNAP QTS or QuTS hero that has addressed the vulnerability.

Which QNAP operating systems are affected by CVE-2023-39303?

CVE-2023-39303 affects multiple QNAP QTS and QuTS Hero versions prior to the latest updates.

Can CVE-2023-39303 be exploited remotely?

Yes, CVE-2023-39303 can be exploited over a network, allowing unauthorized access to the affected systems.

What is the impact of exploiting CVE-2023-39303?

Exploitation of CVE-2023-39303 may allow an attacker to compromise the security of the QNAP system, potentially leading to data loss or unauthorized access.