PT-2024-14092 · Qnap · Qnap Qts+2

Published

2024-04-26

·

Updated

2025-12-10

·

CVE-2023-51365

CVSS v3.1

8.7

High

VectorAV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:H
Name of the Vulnerable Software and Affected Versions QNAP QTS versions prior to 5.1.4.2596 build 20231128 QNAP QTS versions prior to 4.5.4.2627 build 20231225 QNAP QuTS hero versions prior to h5.1.3.2578 build 20231110 QNAP QuTS hero versions prior to h4.5.4.2626 build 20231225 QNAP QuTScloud versions prior to c5.1.5.2651
Description A path traversal vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow users to read the contents of unexpected files and expose sensitive data via a network.
Recommendations For QNAP QTS versions prior to 5.1.4.2596 build 20231128, update to QTS 5.1.4.2596 build 20231128 or later. For QNAP QTS versions prior to 4.5.4.2627 build 20231225, update to QTS 4.5.4.2627 build 20231225 or later. For QNAP QuTS hero versions prior to h5.1.3.2578 build 20231110, update to QuTS hero h5.1.3.2578 build 20231110 or later. For QNAP QuTS hero versions prior to h4.5.4.2626 build 20231225, update to QuTS hero h4.5.4.2626 build 20231225 or later. For QNAP QuTScloud versions prior to c5.1.5.2651, update to QuTScloud c5.1.5.2651 or later.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2023-51365
ZDI-24-476

Affected Products

Qnap Qts
Qnap Quts Hero
Qnap Qutscloud