CVE-2023-45027: QTS, QuTS hero, QuTScloud

Published Feb 2, 2024

Updated

A path traversal vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated administrators to read the contents of unexpected files and expose sensitive data via a network.

We have already fixed the vulnerability in the following versions: QTS 5.1.5.2645 build 20240116 and later QuTS hero h5.1.5.2647 build 20240118 and later QuTScloud c5.1.5.2651 and later

Affected Software

20 affected components

QNAP QTS=5.1.0.2348-build_20230325

QNAP QTS=5.1.0.2399-build_20230515

QNAP QTS=5.1.0.2418-build_20230603

QNAP QTS=5.1.0.2444-build_20230629

QNAP QTS=5.1.0.2466-build_20230721

QNAP QTS=5.1.1.2491-build_20230815

QNAP QTS=5.1.2.2533-build_20230926

QNAP QTS=5.1.3.2578-build_20231110

QNAP QTS=5.1.4.2596-build_20231128

QNAP QTS=5.1.5.2645

QNAP QuTS hero=h5.1.0.2409-build_20230525

QNAP QuTS hero=h5.1.0.2424-build_20230609

QNAP QuTS hero=h5.1.0.2453-build_20230708

QNAP QuTS hero=h5.1.0.2466-build_20230721

QNAP QuTS hero=h5.1.1.2488-build_20230812

QNAP QuTS hero=h5.1.2.2534-build_20230927

QNAP QuTS hero=h5.1.3.2578-build_20231110

QNAP QuTS hero=h5.1.4.2596-build_20231128

QNAP QuTS hero=h5.1.5.2647

QNAP QuTScloud=c5.1.0.2498-build_20230822

Remediation

Information

We have already fixed the vulnerability in the following versions: QTS 5.1.5.2645 build 20240116 and later QuTS hero h5.1.5.2647 build 20240118 and later QuTScloud c5.1.5.2651 and later

Event History

Feb 2, 2024

CVE Published

via MITRE·04:05 PM

Data Sourced

via MITRE·04:05 PM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·04:15 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2023-45027?

CVE-2023-45027 is a medium-severity path traversal vulnerability affecting multiple QNAP QTS versions.

How do I fix CVE-2023-45027?

To mitigate CVE-2023-45027, update your QNAP operating system to the latest patched version as recommended in the security advisory.

Who is affected by CVE-2023-45027?

Authenticated administrators using specific versions of QNAP QTS are affected by CVE-2023-45027.

What type of attack does CVE-2023-45027 allow?

CVE-2023-45027 allows potential attackers to exploit the vulnerability to read sensitive files on the network.

Which QNAP versions are impacted by CVE-2023-45027?

CVE-2023-45027 affects QNAP QTS versions 5.1.0.2348 through 5.1.5.2645, among others listed in the advisory.