CVE-2024-53691: QTS, QuTS hero

Q: What is the severity of CVE-2024-53691?

CVE-2024-53691 is considered a medium severity vulnerability due to the potential for unauthorized file system traversal.

Q: How do I fix CVE-2024-53691?

To fix CVE-2024-53691, it is recommended to update affected QNAP operating systems to the latest version beyond 5.1.8.2823 or h5.1.8.2823.

Q: What systems are affected by CVE-2024-53691?

CVE-2024-53691 affects QNAP QTS versions up to 5.1.8.2823 and QNAP QuTS hero versions up to h5.1.8.2823.

Q: Can CVE-2024-53691 be exploited remotely?

Yes, CVE-2024-53691 can be exploited by remote attackers who already have user access to the affected QNAP devices.

Q: What is the impact of CVE-2024-53691?

The impact of CVE-2024-53691 allows attackers to traverse the file system to access unintended locations, potentially exposing sensitive data.

Published Dec 6, 2024

Updated

A link following vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote attackers who have gained user access to traverse the file system to unintended locations.

We have already fixed the vulnerability in the following versions: QTS 5.1.8.2823 build 20240712 and later QTS 5.2.0.2802 build 20240620 and later QuTS hero h5.1.8.2823 build 20240712 and later QuTS hero h5.2.0.2802 build 20240620 and later

Affected Software

35 affected components

QNAP QTS<5.1.8.2823

QNAP QuTS hero<h5.1.8.2823

QNAP QTS=5.1.0.2348-build_20230325

QNAP QTS=5.1.0.2399-build_20230515

QNAP QTS=5.1.0.2418-build_20230603

QNAP QTS=5.1.0.2444-build_20230629

QNAP QTS=5.1.0.2466-build_20230721

QNAP QTS=5.1.1.2491-build_20230815

QNAP QTS=5.1.2.2533-build_20230926

QNAP QTS=5.1.3.2578-build_20231110

QNAP QTS=5.1.4.2596-build_20231128

QNAP QTS=5.1.5.2645-build_20240116

QNAP QTS=5.1.5.2679-build_20240219

QNAP QTS=5.1.6.2722-build_20240402

QNAP QTS=5.1.7.2770-build_20240520

QNAP QTS=5.2.0.2737-build_20240417

QNAP QTS=5.2.0.2744-build_20240424

QNAP QTS=5.2.0.2782-build_20240601

QNAP QuTS hero=h5.1.0.2409-build_20230525

QNAP QuTS hero=h5.1.0.2424-build_20230609

QNAP QuTS hero=h5.1.0.2453-build_20230708

QNAP QuTS hero=h5.1.0.2466-build_20230721

QNAP QuTS hero=h5.1.1.2488-build_20230812

QNAP QuTS hero=h5.1.2.2534-build_20230927

QNAP QuTS hero=h5.1.3.2578-build_20231110

QNAP QuTS hero=h5.1.4.2596-build_20231128

QNAP QuTS hero=h5.1.5.2647-build_20240118

QNAP QuTS hero=h5.1.5.2680-build_20240220

QNAP QuTS hero=h5.1.6.2734-build_20240414

QNAP QuTS hero=h5.1.7.2770-build_20240520

QNAP QuTS hero=h5.1.7.2788-build_20240607

QNAP QuTS hero=h5.1.7.2794-build_20240613

QNAP QuTS hero=h5.2.0.2737-build_20240417

QNAP QuTS hero=h5.2.0.2782-build_20240601

QNAP QuTS hero=h5.2.0.2789-build_20240607

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade QNAP QTS to a version that resolves this vulnerability.
Fixed in 5.1.8.2823
Upgrade
Upgrade QNAP QTS to a version that resolves this vulnerability.
Fixed in 5.2.0.2802
Upgrade
Upgrade QNAP QuTS hero to a version that resolves this vulnerability.
Fixed in h5.1.8.2823
Upgrade
Upgrade QNAP QuTS hero to a version that resolves this vulnerability.
Fixed in h5.2.0.2802

Event History

Dec 6, 2024

CVE Published

via MITRE·04:34 PM

Data Sourced

via MITRE·04:34 PM

RemedyDescriptionWeakness

Data Sourced

via NVD·05:15 PM

DescriptionSeverityWeaknessAffected Software

Jan 13, 2025

Exploit Published

via GitHub·10:07 AM

Frequently Asked Questions

What is the severity of CVE-2024-53691?

CVE-2024-53691 is considered a medium severity vulnerability due to the potential for unauthorized file system traversal.

How do I fix CVE-2024-53691?