CVE-2024-21905: QTS, QuTS hero, QuTScloud
An integer overflow or wraparound vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow users to compromise the security of the system via a network.
We have already fixed the vulnerability in the following versions: QTS 5.1.3.2578 build 20231110 and later QuTS hero h5.1.3.2578 build 20231110 and later QuTScloud c5.1.5.2651 and later
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is the severity of CVE-2024-21905?
CVE-2024-21905 has been classified as a high-severity vulnerability due to its potential to compromise system security through integer overflow.
How do I fix CVE-2024-21905?
To fix CVE-2024-21905, update your QNAP operating system to the latest version available beyond 5.1.3.2578 for QTS and QuTS hero, or beyond 5.1.5.2651 for QuTScloud.
What happens if I don't patch CVE-2024-21905?
Failing to patch CVE-2024-21905 may lead to unauthorized access and control of your QNAP system by attackers.
Which QNAP versions are vulnerable to CVE-2024-21905?
CVE-2024-21905 affects QNAP QTS and QuTS hero versions up to 5.1.3.2578 and QuTScloud versions up to 5.1.5.2651.
Is CVE-2024-21905 actively being exploited in the wild?
As of now, there are no confirmed reports of active exploitation for CVE-2024-21905, but prompt patching is recommended to mitigate risks.