PT-2025-10109 · Qnap · Qulog Center+2

Aymen Borgi + 1 · Published 2025-03-07 · Updated 2025-12-06 · CVE-2024-53696

Positive Technologies (AI Summary)

CVSS v4.0

5.1

Medium

Base vector

AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions QuLog Center versions prior to 1.7.0.829 QuLog Center versions prior to 1.8.0.888 QTS versions prior to 4.5.4.2957 build 20241119 QuTS hero versions prior to 4.5.4.2956 build 20241119

Description A server-side request forgery (SSRF) issue has been identified, which could allow remote attackers with administrator access to read application data.

Recommendations For QuLog Center versions prior to 1.7.0.829, update to version 1.7.0.829 or later. For QuLog Center versions prior to 1.8.0.888, update to version 1.8.0.888 or later. For QTS versions prior to 4.5.4.2957 build 20241119, update to version 4.5.4.2957 build 20241119 or later. For QuTS hero versions prior to 4.5.4.2956 build 20241119, update to version 4.5.4.2956 build 20241119 or later.

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2024-53696

Affected Products

Qts

Qulog Center

Quts Hero

References · 7

• https://qnap.com/en/security-advisory/qsa-24-53 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-53696 · Security Note
• https://osv.dev/vulnerability/CVE-2024-53696 · Vendor Advisory
• https://twitter.com/CVEnew/status/1898246352825454595 · Twitter Post
• https://t.me/cveNotify/144982 · Telegram Post
• https://t.me/cvedetector/19843 · Telegram Post
• https://t.me/cvetracker/18697 · Telegram Post