Read the docs
TI-2023-16155 Aliases CVE-2023-32967GHSA-m8v6-ghjm-p88m

Improper authorization in QNAP QuTScloud

Priority LOW 29CWE-285Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
None · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-285.

Summary

An incorrect authorization vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated users to bypass intended access restrictions via a network. QTS 5.x, QuTS hero are not affected. We have already fixed the vulnerability in the following versions: QuTScloud c5.1.5.2651 and later QTS 4.5.4.2627 build 20231225 and later

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00329 26th percentileScored 2026-11-07
Fix Fixed QuTScloud (QNAP Systems Inc.): c5.1.5.2651QTS (QNAP Systems Inc.): 4.5.4.2627 build 20231225, 5.1.x+1 more product

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
QNAPQuTScloudc5.x.x to before c5.1.5.2651c5.1.5.2651Patch availableCNA
QNAPQTS4.5.x to before 4.5.4.2627 build 202312254.5.4.2627 build 20231225, 5.1.xPatch availableCNA
QNAPQuTS hero—h5.1.x, h4.5.xPatch availableCNA
  • QuTScloud VendorQNAP Affected c5.x.x to before c5.1.5.2651 Fixed in c5.1.5.2651 Patch available CNA
  • QTS VendorQNAP Affected 4.5.x to before 4.5.4.2627 build 20231225 Fixed in 4.5.4.2627 build 20231225, 5.1.x Patch available CNA
  • QuTS hero VendorQNAP Affected — Fixed in h5.1.x, h4.5.x Patch available CNA

CPE configurations NVD · 13

CPEVersionsRoleVendor
cpe:2.3:o:qnap:qts:4.5.4.1715:build_20210630:*:*:*:*:*:*4.5.4.1715 build_20210630VulnerableQNAP
cpe:2.3:o:qnap:qts:4.5.4.1723:build_20210708:*:*:*:*:*:*4.5.4.1723 build_20210708VulnerableQNAP
cpe:2.3:o:qnap:qts:4.5.4.1741:build_20210726:*:*:*:*:*:*4.5.4.1741 build_20210726VulnerableQNAP
cpe:2.3:o:qnap:qts:4.5.4.1787:build_20210910:*:*:*:*:*:*4.5.4.1787 build_20210910VulnerableQNAP
cpe:2.3:o:qnap:qts:4.5.4.1800:build_20210923:*:*:*:*:*:*4.5.4.1800 build_20210923VulnerableQNAP
cpe:2.3:o:qnap:qts:4.5.4.1892:build_20211223:*:*:*:*:*:*4.5.4.1892 build_20211223VulnerableQNAP
cpe:2.3:o:qnap:qts:4.5.4.1931:build_20220128:*:*:*:*:*:*4.5.4.1931 build_20220128VulnerableQNAP
cpe:2.3:o:qnap:qts:4.5.4.2012:build_20220419:*:*:*:*:*:*4.5.4.2012 build_20220419VulnerableQNAP
cpe:2.3:o:qnap:qts:4.5.4.2117:build_20220802:*:*:*:*:*:*4.5.4.2117 build_20220802VulnerableQNAP
cpe:2.3:o:qnap:qts:4.5.4.2280:build_20230112:*:*:*:*:*:*4.5.4.2280 build_20230112VulnerableQNAP
  • cpe:2.3:o:qnap:qts:4.5.4.1715:build_20210630:*:*:*:*:*:* Versions 4.5.4.1715 build_20210630 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.5.4.1723:build_20210708:*:*:*:*:*:* Versions 4.5.4.1723 build_20210708 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.5.4.1741:build_20210726:*:*:*:*:*:* Versions 4.5.4.1741 build_20210726 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.5.4.1787:build_20210910:*:*:*:*:*:* Versions 4.5.4.1787 build_20210910 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.5.4.1800:build_20210923:*:*:*:*:*:* Versions 4.5.4.1800 build_20210923 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.5.4.1892:build_20211223:*:*:*:*:*:* Versions 4.5.4.1892 build_20211223 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.5.4.1931:build_20220128:*:*:*:*:*:* Versions 4.5.4.1931 build_20220128 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.5.4.2012:build_20220419:*:*:*:*:*:* Versions 4.5.4.2012 build_20220419 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.5.4.2117:build_20220802:*:*:*:*:*:* Versions 4.5.4.2117 build_20220802 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.5.4.2280:build_20230112:*:*:*:*:*:* Versions 4.5.4.2280 build_20230112 Vulnerable ·QNAP
Show 3 more CPE
CPEVersionsRoleVendor
cpe:2.3:o:qnap:qts:4.5.4.2374:build_20230416:*:*:*:*:*:*4.5.4.2374 build_20230416VulnerableQNAP
cpe:2.3:o:qnap:qts:4.5.4.2627:-:*:*:*:*:*:*4.5.4.2627VulnerableQNAP
cpe:2.3:o:qnap:qutscloud:c5.1.0.2498:build_20230822:*:*:*:*:*:*c5.1.0.2498 build_20230822VulnerableQNAP
  • cpe:2.3:o:qnap:qts:4.5.4.2374:build_20230416:*:*:*:*:*:* Versions 4.5.4.2374 build_20230416 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.5.4.2627:-:*:*:*:*:*:* Versions 4.5.4.2627 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qutscloud:c5.1.0.2498:build_20230822:*:*:*:*:*:* Versions c5.1.0.2498 build_20230822 Vulnerable ·QNAP

Remediation

  • Fix · CNA QuTScloud (QNAP Systems Inc.) Fixed in c5.1.5.2651
  • Fix · CNA QTS (QNAP Systems Inc.) Fixed in 4.5.4.2627 build 20231225, 5.1.x
  • Fix · CNA QuTS hero (QNAP Systems Inc.) Fixed in h5.1.x, h4.5.x

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    QNAP Systems QuTScloud c5.1.5.2651

    26 records Highest priority Priority MEDIUM 5 MEDIUM, 21 LOW

    Other records, highest priority first

    Show all 26 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-32967
  2. 2026-10-03 Alias added: GHSA-m8v6-ghjm-p88m

References

Advisory 1

  • TI-2020-02221 Command Injection Vulnerability in QTS and QuTS hero KEVCVSS 3.1CRITICAL 9.8
  • TI-2019-05101 Improper input validation in QNAP NAS devices KEVCVSS 3.1CRITICAL 9.8
  • TI-2018-14137 Improper input validation in QNAP QTS KEVCVSS 3.1CRITICAL 9.8
  • TI-2014-05975 GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed… KEVCVSS 3.1CRITICAL 9.8
  • TI-2014-05157 GNU Bash through 4.3 processes trailing strings after function definitions in the values… KEVCVSS 3.1CRITICAL 9.8
  • TI-2018-14131 Cross-site scripting in QNAP QTS KEVCVSS 3.1HIGH 8.0
See all 282 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences