CVE-2023-45036: QTS, QuTS hero, QuTScloud

Published Feb 2, 2024

Updated

A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated administrators to execute code via a network.

We have already fixed the vulnerability in the following versions: QTS 5.1.3.2578 build 20231110 and later QuTS hero h5.1.3.2578 build 20231110 and later QuTScloud c5.1.5.2651 and later

Affected Software

16 affected components

QNAP QTS=5.1.0.2348-build_20230325

QNAP QTS=5.1.0.2399-build_20230515

QNAP QTS=5.1.0.2418-build_20230603

QNAP QTS=5.1.0.2444-build_20230629

QNAP QTS=5.1.0.2466-build_20230721

QNAP QTS=5.1.1.2491-build_20230815

QNAP QTS=5.1.2.2533-build_20230926

QNAP QTS=5.1.3.2578

QNAP QuTS hero=h5.1.0.2409-build_20230525

QNAP QuTS hero=h5.1.0.2424-build_20230609

QNAP QuTS hero=h5.1.0.2453-build_20230708

QNAP QuTS hero=h5.1.0.2466-build_20230721

QNAP QuTS hero=h5.1.1.2488-build_20230812

QNAP QuTS hero=h5.1.2.2534-build_20230927

QNAP QuTS hero=h5.1.3.2578

QNAP QuTScloud=c5.1.0.2498-build_20230822

Remediation

Information

We have already fixed the vulnerability in the following versions: QTS 5.1.3.2578 build 20231110 and later QuTS hero h5.1.3.2578 build 20231110 and later QuTScloud c5.1.5.2651 and later

Event History

Feb 2, 2024

CVE Published

via MITRE·04:05 PM

Data Sourced

via MITRE·04:05 PM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·04:15 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2023-45036?

CVE-2023-45036 is classified as a high severity vulnerability due to its potential for remote code execution.

How do I fix CVE-2023-45036?

To fix CVE-2023-45036, upgrade your QNAP operating system to the patched versions provided by QNAP.

Which QNAP operating systems are affected by CVE-2023-45036?

CVE-2023-45036 affects various versions of QNAP QTS, QuTS hero, and QuTScloud, specifically those indicated in the vulnerability report.

Is it safe to use QNAP devices without applying the patch for CVE-2023-45036?

Using QNAP devices without applying the patch for CVE-2023-45036 is not safe and could expose your system to significant security risks.

What type of attack can exploit CVE-2023-45036?

CVE-2023-45036 can be exploited by authenticated administrators to execute arbitrary code via a network.