CVE-2023-39303

MEDIUM

QNAP QTS, QuTS hero, and QuTScloud - Improper Authentication

Title source: llm
STIX 2.1

Description

An improper authentication vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow users to compromise the security of the system via a network. We have already fixed the vulnerability in the following versions: QTS 5.1.3.2578 build 20231110 and later QuTS hero h5.1.3.2578 build 20231110 and later QuTScloud c5.1.5.2651 and later

References (1)

Core 1
Core References

Scores

CVSS v3 5.3
EPSS 0.0020
EPSS Percentile 41.2%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable yes
Technical Impact partial

Details

CWE
CWE-287
Status published
Products (16)
qnap/qts 5.1.0.2348 build_20230325
qnap/qts 5.1.0.2399 build_20230515
qnap/qts 5.1.0.2418 build_20230603
qnap/qts 5.1.0.2444 build_20230629
qnap/qts 5.1.0.2466 build_20230721
qnap/qts 5.1.1.2491 build_20230815
qnap/qts 5.1.2.2533 build_20230926
qnap/qts 5.1.3.2578
qnap/quts_hero h5.1.0.2409 build_20230525
qnap/quts_hero h5.1.0.2424 build_20230609
... and 6 more
Published Feb 02, 2024
Tracked Since Feb 18, 2026