PT-2024-1631 · Qnap · Qts+2

Bingwei Peng + 1 · Published 2024-02-02 · Updated 2024-02-06 · CVE-2023-45037

Positive Technologies (AI Summary)

CVSS v2.0

8.3

High

Base vector

AV:N/AC:L/Au:M/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions QTS versions prior to 5.1.3.2578 build 20231110 QuTS hero versions prior to h5.1.3.2578 build 20231110 QuTScloud versions prior to c5.1.5.2651

Description The issue is related to a buffer copy without checking the size of input data, which could allow a remote attacker to execute arbitrary code. If exploited, the vulnerability could allow authenticated administrators to execute code via a network.

Recommendations For QTS versions prior to 5.1.3.2578 build 20231110, update to version 5.1.3.2578 build 20231110 or later. For QuTS hero versions prior to h5.1.3.2578 build 20231110, update to version h5.1.3.2578 build 20231110 or later. For QuTScloud versions prior to c5.1.5.2651, update to version c5.1.5.2651 or later.

Fix

Buffer Overflow

Weakness Enumeration

CWE-120

Related Identifiers

BDU:2024-01298

CVE-2023-45037

Affected Products

Qts

Quts Hero

Qutscloud

References · 6

• https://qnap.com/en/security-advisory/qsa-23-46 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-45037 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-01298 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-45037 · Security Note
• https://twitter.com/CVEnew/status/1753452515742392544 · Twitter Post
• https://vuldb.com/ru/?id.252726 · Note