Description
A vulnerability has been reported to affect QNAP operating systems. If exploited, the out-of-bounds read vulnerability allows remote authenticated administrators to get secret values. The vulnerability affects the following QNAP operating systems: QTS, QuTS hero, QuTScloud, QVP (QVR Pro appliances) We have already fixed the vulnerability in the following versions: QTS 5.0.1.2346 build 20230322 and later QuTS hero h5.0.1.2348 build 20230324 and later
Scores
CVSS v3
2.7
EPSS
0.0035
EPSS Percentile
57.3%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
no
Technical Impact
partial
Details
CWE
CWE-125
CWE-489
CWE-1295
Status
published
Products (11)
qnap/qts
< 5.0.1.2346
qnap/quts_hero
< h5.0.1.2348
qnap/qutscloud
qnap/qvp-21a_firmware
qnap/qvp-41a_firmware
qnap/qvp-41b_firmware
qnap/qvp-63a_firmware
qnap/qvp-63b_firmware
qnap/qvp-85a_firmware
qnap/qvp-85b_firmware
... and 1 more
Published
Mar 29, 2023
Tracked Since
Feb 18, 2026