CVE-2023-45028: QTS, QuTS hero, QuTScloud

Published Feb 2, 2024

Updated

An uncontrolled resource consumption vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated administrators to launch a denial-of-service (DoS) attack via a network.

We have already fixed the vulnerability in the following versions: QTS 5.1.5.2645 build 20240116 and later QuTS hero h5.1.5.2647 build 20240118 and later QuTScloud c5.1.5.2651 and later

Affected Software

20 affected components

QNAP QTS=5.1.0.2348-build_20230325

QNAP QTS=5.1.0.2399-build_20230515

QNAP QTS=5.1.0.2418-build_20230603

QNAP QTS=5.1.0.2444-build_20230629

QNAP QTS=5.1.0.2466-build_20230721

QNAP QTS=5.1.1.2491-build_20230815

QNAP QTS=5.1.2.2533-build_20230926

QNAP QTS=5.1.3.2578-build_20231110

QNAP QTS=5.1.4.2596-build_20231128

QNAP QTS=5.1.5.2645

QNAP QuTS hero=h5.1.0.2409-build_20230525

QNAP QuTS hero=h5.1.0.2424-build_20230609

QNAP QuTS hero=h5.1.0.2453-build_20230708

QNAP QuTS hero=h5.1.0.2466-build_20230721

QNAP QuTS hero=h5.1.1.2488-build_20230812

QNAP QuTS hero=h5.1.2.2534-build_20230927

QNAP QuTS hero=h5.1.3.2578-build_20231110

QNAP QuTS hero=h5.1.4.2596-build_20231128

QNAP QuTS hero=h5.1.5.2647

QNAP QuTScloud=c5.1.0.2498-build_20230822

Remediation

Information

We have already fixed the vulnerability in the following versions: QTS 5.1.5.2645 build 20240116 and later QuTS hero h5.1.5.2647 build 20240118 and later QuTScloud c5.1.5.2651 and later

Event History

Feb 2, 2024

CVE Published

via MITRE·04:05 PM

Data Sourced

via MITRE·04:05 PM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·04:15 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2023-45028?

CVE-2023-45028 is classified as an uncontrolled resource consumption vulnerability that may lead to denial-of-service (DoS) attacks.

How do I fix CVE-2023-45028?

To fix CVE-2023-45028, ensure that you upgrade your QNAP operating system to a patched version that addresses this vulnerability.

What operating system versions are affected by CVE-2023-45028?

CVE-2023-45028 affects several QNAP QTS and QuTS hero versions including 5.1.0.2348 to 5.1.5.2645 and corresponding QuTS hero versions.

Who is affected by CVE-2023-45028?

Only authenticated administrators of the affected QNAP systems are at risk from the CVE-2023-45028 vulnerability.

Can CVE-2023-45028 be exploited remotely?

Yes, CVE-2023-45028 can be exploited via a network, allowing authorized users to potentially launch DoS attacks.