CVE-2024-48865

HIGH

QNAP QTS and QuTS hero - Improper Certificate Validation

Title source: llm
STIX 2.1

Description

An improper certificate validation vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow attackers with local network access to compromise the security of the system. We have already fixed the vulnerability in the following versions: QTS 5.1.9.2954 build 20241120 and later QTS 5.2.2.2950 build 20241114 and later QuTS hero h5.1.9.2954 build 20241120 and later QuTS hero h5.2.2.2952 build 20241116 and later

References (1)

Core 1
Core References

Scores

CVSS v3 7.5
EPSS 0.0012
EPSS Percentile 29.9%
Attack Vector ADJACENT_NETWORK
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact total

Details

CWE
CWE-295
Status published
Products (46)
qnap/qts 5.1.0.2348 build_20230325
qnap/qts 5.1.0.2399 build_20230515
qnap/qts 5.1.0.2418 build_20230603
qnap/qts 5.1.0.2444 build_20230629
qnap/qts 5.1.0.2466 build_20230721
qnap/qts 5.1.1.2491 build_20230815
qnap/qts 5.1.2.2533 build_20230926
qnap/qts 5.1.3.2578 build_20231110
qnap/qts 5.1.4.2596 build_20231128
qnap/qts 5.1.5.2645 build_20240116
... and 36 more
Published Dec 06, 2024
Tracked Since Feb 18, 2026