QNAP NAS Multiple Vulnerabilities

Release Date: 30 Mar 2023 4648 Views

RISK: Medium Risk

TYPE: Servers - Other Servers

Multiple vulnerabilities were identified in QNAP NAS. A remote attacker could exploit some of these vulnerabilities to trigger denial of service condition, elevation of privilege, remote code execution and sensitive information disclosure on the targeted system.

Impact

Denial of Service
Elevation of Privilege
Remote Code Execution
Information Disclosure

System / Technologies affected

QTS version prior to 5.0.1.2346 build 20230322
QuTS hero version prior to h5.0.1.2348 build 20230324
QuTScloud
QVP (QVR Pro appliances)
QVR
QES

Solutions

Before installation of the software, please visit the vendor web-site for more details.

Apply fixes issued by the vendor:
https://www.qnap.com/en/security-advisory/qsa-23-02
https://www.qnap.com/en/security-advisory/qsa-23-03
https://www.qnap.com/en/security-advisory/qsa-23-06
https://www.qnap.com/en/security-advisory/qsa-23-10
https://www.qnap.com/en/security-advisory/qsa-23-11
https://www.qnap.com/en/security-advisory/qsa-23-15

Vulnerability Identifier

Source

QNAP