PT-2023-8505 · Qnap · Qutscloud+2

Rekter0 · Published 2023-07-27 · Updated 2024-02-06 · CVE-2023-39303

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions QTS versions prior to 5.1.3.2578 build 20231110 QuTS hero versions prior to h5.1.3.2578 build 20231110 QuTScloud versions prior to c5.1.5.2651

Description The issue is related to improper authentication procedures in QNAP operating systems, which could allow a remote attacker to compromise the target system.

Recommendations For QTS versions prior to 5.1.3.2578 build 20231110, update to version 5.1.3.2578 build 20231110 or later. For QuTS hero versions prior to h5.1.3.2578 build 20231110, update to version h5.1.3.2578 build 20231110 or later. For QuTScloud versions prior to c5.1.5.2651, update to version c5.1.5.2651 or later.

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

BDU:2024-01043

CVE-2023-39303

Affected Products

Qts

Quts Hero

Qutscloud

References · 7

• https://osv.dev/vulnerability/CVE-2023-39303 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-01043 · Security Note
• https://qnap.com/en/security-advisory/qsa-23-33 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-39303 · Security Note
• https://twitter.com/RedPacketSec/status/1754808394706276712 · Twitter Post
• https://vuldb.com/ru/?id.252746 · Note
• https://twitter.com/CVEnew/status/1753452535635976593 · Twitter Post