CVE-2023-51367 | ByteOS Network

Vulnerability Details :

CVE-2023-51367

Assigner-qnap

Assigner Org ID-2fd009eb-170a-4625-932b-17a53af1051f

Published At-06 Sep, 2024 | 16:26

Updated At-06 Sep, 2024 | 17:39

QTS, QuTS hero

A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow users to execute code via a network. We have already fixed the vulnerability in the following versions: QTS 5.1.6.2722 build 20240402 and later QuTS hero h5.1.6.2734 build 20240414 and later

EPSS History

Score

Latest Score

-

N/A

Percentile

Latest Percentile

-

N/A

▼Common Vulnerabilities and Exposures (CVE)

Assigner:qnap

Assigner Org ID:2fd009eb-170a-4625-932b-17a53af1051f

Published At:06 Sep, 2024 | 16:26

Updated At:06 Sep, 2024 | 17:39

▼CVE Numbering Authority (CNA)

QTS, QuTS hero

A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow users to execute code via a network. We have already fixed the vulnerability in the following versions: QTS 5.1.6.2722 build 20240402 and later QuTS hero h5.1.6.2734 build 20240414 and later

Affected Products

Vendor

QNAP Systems, Inc.

Product

Default Status

unaffected

Versions

Affected

From 5.1.x before 5.1.6.2722 build 20240402 (custom)

Vendor

QNAP Systems, Inc.

Product

Default Status

unaffected

Versions

Unaffected

From h5.1.x before h5.1.6.2734 build 20240414 (custom)

Problem Types

Type	CWE ID	Description
CWE	CWE-120	CWE-120
CWE	CWE-121	CWE-121

Type: CWE

CWE ID: CWE-120

Description: CWE-120

Type: CWE

CWE ID: CWE-121

Description: CWE-121

Metrics

Version	Base score	Base severity	Vector
3.1	5.4	MEDIUM	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:L

Version: 3.1

Base score: 5.4

Base severity: MEDIUM

Vector:

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:L

Impacts

CAPEC ID	Description
CAPEC-100	CAPEC-100

CAPEC ID: CAPEC-100

Description: CAPEC-100

Solutions

We have already fixed the vulnerability in the following versions: QTS 5.1.6.2722 build 20240402 and later QuTS hero h5.1.6.2734 build 20240414 and later

Credits

finder

chumen77

References

Hyperlink	Resource
https://www.qnap.com/en/security-advisory/qsa-24-20	N/A

Hyperlink: https://www.qnap.com/en/security-advisory/qsa-24-20

Resource: N/A

▼Authorized Data Publishers (ADP)

CISA ADP Vulnrichment

Metrics Other Info

▼National Vulnerability Database (NVD)

Source:security@qnapsecurity.com.tw

Published At:06 Sep, 2024 | 17:15

Updated At:11 Sep, 2024 | 13:27

A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow users to execute code via a network. We have already fixed the vulnerability in the following versions: QTS 5.1.6.2722 build 20240402 and later QuTS hero h5.1.6.2734 build 20240414 and later

Metrics

Type	Version	Base score	Base severity	Vector
Primary	3.1	8.8	HIGH	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Secondary	3.1	5.4	MEDIUM	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:L

Type: Primary

Version: 3.1

Base score: 8.8

Base severity: HIGH

Vector:

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Type: Secondary

Version: 3.1

Base score: 5.4

Base severity: MEDIUM

Vector:

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:L

CPE Matches

QNAP Systems, Inc.

>>qts>>5.1.0.2348

cpe:2.3:o:qnap:qts:5.1.0.2348:build_20230325:*:*:*:*:*:*

QNAP Systems, Inc.

>>qts>>5.1.0.2399

cpe:2.3:o:qnap:qts:5.1.0.2399:build_20230515:*:*:*:*:*:*

QNAP Systems, Inc.

>>qts>>5.1.0.2418

cpe:2.3:o:qnap:qts:5.1.0.2418:build_20230603:*:*:*:*:*:*

QNAP Systems, Inc.

>>qts>>5.1.0.2444

cpe:2.3:o:qnap:qts:5.1.0.2444:build_20230629:*:*:*:*:*:*

QNAP Systems, Inc.

>>qts>>5.1.0.2466

cpe:2.3:o:qnap:qts:5.1.0.2466:build_20230721:*:*:*:*:*:*

QNAP Systems, Inc.

>>qts>>5.1.1.2491

cpe:2.3:o:qnap:qts:5.1.1.2491:build_20230815:*:*:*:*:*:*

QNAP Systems, Inc.

>>qts>>5.1.2.2533

cpe:2.3:o:qnap:qts:5.1.2.2533:build_20230926:*:*:*:*:*:*

QNAP Systems, Inc.

>>qts>>5.1.3.2578

cpe:2.3:o:qnap:qts:5.1.3.2578:build_20231110:*:*:*:*:*:*

QNAP Systems, Inc.

>>qts>>5.1.4.2596

cpe:2.3:o:qnap:qts:5.1.4.2596:build_20231128:*:*:*:*:*:*

QNAP Systems, Inc.

>>qts>>5.1.5.2645

cpe:2.3:o:qnap:qts:5.1.5.2645:build_20240116:*:*:*:*:*:*

QNAP Systems, Inc.

>>qts>>5.1.5.2679

cpe:2.3:o:qnap:qts:5.1.5.2679:build_20240219:*:*:*:*:*:*

QNAP Systems, Inc.

>>quts_hero>>h5.1.0.2409

cpe:2.3:o:qnap:quts_hero:h5.1.0.2409:build_20230525:*:*:*:*:*:*

QNAP Systems, Inc.

>>quts_hero>>h5.1.0.2424

cpe:2.3:o:qnap:quts_hero:h5.1.0.2424:build_20230609:*:*:*:*:*:*

QNAP Systems, Inc.

>>quts_hero>>h5.1.0.2453

cpe:2.3:o:qnap:quts_hero:h5.1.0.2453:build_20230708:*:*:*:*:*:*

QNAP Systems, Inc.

>>quts_hero>>h5.1.0.2466

cpe:2.3:o:qnap:quts_hero:h5.1.0.2466:build_20230721:*:*:*:*:*:*

QNAP Systems, Inc.

>>quts_hero>>h5.1.1.2488

cpe:2.3:o:qnap:quts_hero:h5.1.1.2488:build_20230812:*:*:*:*:*:*

QNAP Systems, Inc.

>>quts_hero>>h5.1.2.2534

cpe:2.3:o:qnap:quts_hero:h5.1.2.2534:build_20230927:*:*:*:*:*:*

QNAP Systems, Inc.

>>quts_hero>>h5.1.3.2578

cpe:2.3:o:qnap:quts_hero:h5.1.3.2578:build_20231110:*:*:*:*:*:*

QNAP Systems, Inc.

>>quts_hero>>h5.1.4.2596

cpe:2.3:o:qnap:quts_hero:h5.1.4.2596:build_20231128:*:*:*:*:*:*

QNAP Systems, Inc.

>>quts_hero>>h5.1.5.2647

cpe:2.3:o:qnap:quts_hero:h5.1.5.2647:build_20240118:*:*:*:*:*:*

QNAP Systems, Inc.

>>quts_hero>>h5.1.5.2680

cpe:2.3:o:qnap:quts_hero:h5.1.5.2680:build_20240220:*:*:*:*:*:*

Weaknesses

CWE ID	Type	Source
CWE-120	Primary	security@qnapsecurity.com.tw
CWE-121	Primary	security@qnapsecurity.com.tw

CWE ID: CWE-120

Type: Primary

Source: security@qnapsecurity.com.tw

CWE ID: CWE-121

Type: Primary

Source: security@qnapsecurity.com.tw

References

Hyperlink	Source	Resource
https://www.qnap.com/en/security-advisory/qsa-24-20	security@qnapsecurity.com.tw	Vendor Advisory

Hyperlink: https://www.qnap.com/en/security-advisory/qsa-24-20

Source: security@qnapsecurity.com.tw

Resource:

Vendor Advisory