PT-2025-10100 · Qnap · Qnap Qts+1

Leeya_Bug · Published 2025-03-07 · Updated 2025-09-23 · CVE-2024-38638

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions QNAP QTS versions prior to 5.1.9.2954 build 20241120 QNAP QuTS hero h5.1.9 versions prior to 5.1.9.2954 build 20241120

Description An out-of-bounds write issue has been reported, potentially allowing remote attackers with administrator access to modify or corrupt memory.

Recommendations For QNAP QTS versions prior to 5.1.9.2954 build 20241120, update to QTS 5.1.9.2954 build 20241120 or later. For QNAP QuTS hero h5.1.9 versions prior to 5.1.9.2954 build 20241120, update to QuTS hero h5.1.9.2954 build 20241120 or later.

Fix

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

CVE-2024-38638

Affected Products

Qnap Qts

Quts Hero H5.1.9

References · 7

• https://osv.dev/vulnerability/CVE-2024-38638 · Vendor Advisory
• https://qnap.com/en/security-advisory/qsa-24-52 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-38638 · Security Note
• https://t.me/cvetracker/18688 · Telegram Post
• https://t.me/cvedetector/19856 · Telegram Post
• https://t.me/cveNotify/136165 · Telegram Post
• https://twitter.com/CVEnew/status/1898246360727445590 · Twitter Post