CVE-2024-27130: QTS, QuTS hero

Published May 21, 2024
·
Updated

A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow users to execute code via a network.

We have already fixed the vulnerability in the following version: QTS 5.1.7.2770 build 20240520 and later QuTS hero h5.1.7.2770 build 20240520 and later

Affected Software

23 affected components
QNAP QTS=5.1.0.2348-build_20230325
QNAP QTS=5.1.0.2399-build_20230515
QNAP QTS=5.1.0.2418-build_20230603
QNAP QTS=5.1.0.2444-build_20230629
QNAP QTS=5.1.0.2466-build_20230721
QNAP QTS=5.1.1.2491-build_20230815
QNAP QTS=5.1.2.2533-build_20230926
QNAP QTS=5.1.3.2578-build_20231110
QNAP QTS=5.1.4.2596-build_20231128
QNAP QTS=5.1.5.2645-build_20240116
QNAP QTS=5.1.5.2679-build_20240219
QNAP QTS=5.1.6.2722-build_20240402
QNAP QuTS hero=h5.1.0.2409-build_20230525
QNAP QuTS hero=h5.1.0.2424-build_20230609
QNAP QuTS hero=h5.1.0.2453-build_20230708
QNAP QuTS hero=h5.1.0.2466-build_20230721
QNAP QuTS hero=h5.1.1.2488-build_20230812
QNAP QuTS hero=h5.1.2.2534-build_20230927
QNAP QuTS hero=h5.1.3.2578-build_20231110
QNAP QuTS hero=h5.1.4.2596-build_20231128
QNAP QuTS hero=h5.1.5.2647-build_20240118
QNAP QuTS hero=h5.1.5.2680-build_20240220
QNAP QuTS hero=h5.1.6.2734-build_20240414

Remediation

Information

We have already fixed the vulnerability in the following version: QTS 5.1.7.2770 build 20240520 and later QuTS hero h5.1.7.2770 build 20240520 and later

Event History

May 20, 2024
News Published
via The Register·02:00 PM
News Published
via The Register·02:03 PM
News Published
via BleepingComputer·02:57 PM
News Published
via BleepingComputer·02:58 PM
May 21, 2024
CVE Published
via MITRE·04:08 PM
Data Sourced
via MITRE·04:08 PM
RemedyDescriptionSeverityWeakness
Data Sourced
via NVD·04:15 PM
DescriptionSeverityWeakness

Frequently Asked Questions

1

What is the severity of CVE-2024-27130?

CVE-2024-27130 has been assessed as a high severity vulnerability due to the potential for remote code execution.

2

How do I fix CVE-2024-27130?

To fix CVE-2024-27130, update to the latest version of QTS, specifically versions 5.1.7 or higher.

3

Which versions of QTS are affected by CVE-2024-27130?

CVE-2024-27130 affects QTS versions from 5.1.0.2348 to 5.1.6.2722.

4

Can CVE-2024-27130 be exploited remotely?

Yes, CVE-2024-27130 can be exploited remotely over a network if the conditions are met.

5

What type of vulnerability is CVE-2024-27130?

CVE-2024-27130 is a buffer copy without checking size of input vulnerability.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203