Buffer overflow in QNAP QTS
Priority LOW 33CWE-120Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- High
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-120 and the CVSS impact.
Summary
A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated administrators to execute code via a network. We have already fixed the vulnerability in the following versions: QTS 5.0.1.2514 build 20230906 and later QTS 5.1.2.2533 build 20230926 and later QuTS hero h5.0.1.2515 build 20230907 and later QuTS hero h5.1.2.2534 build 20230927 and later
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00868 58th percentileScored 2026-11-07
Fix Fixed QTS (QNAP Systems Inc.): 5.0.1.2514 build 20230906, 5.1.2.2533 build 20230926QuTS hero (QNAP Systems Inc.): h5.0.1.2515 build 20230907, h5.1.2.2534 build 20230927
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| QNAP | QTS | 5.0.x to before 5.0.1.2514 build 20230906; 5.1.x to before 5.1.2.2533 build 20230926 | 5.0.1.2514 build 20230906, 5.1.2.2533 build 20230926 | Patch available | CNA |
| QNAP | QuTS hero | h5.0.x to before h5.0.1.2515 build 20230907; h5.1.x to before h5.1.2.2534 build 20230927 | h5.0.1.2515 build 20230907, h5.1.2.2534 build 20230927 | Patch available | CNA |
- QTS VendorQNAP Affected 5.0.x to before 5.0.1.2514 build 20230906; 5.1.x to before 5.1.2.2533 build 20230926 Fixed in 5.0.1.2514 build 20230906, 5.1.2.2533 build 20230926 Patch available CNA
- QuTS hero VendorQNAP Affected h5.0.x to before h5.0.1.2515 build 20230907; h5.1.x to before h5.1.2.2534 build 20230927 Fixed in h5.0.1.2515 build 20230907, h5.1.2.2534 build 20230927 Patch available CNA
CPE configurations NVD · 31
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:qnap:qts:5.1.0.2348:build_20230325:*:*:*:*:*:* | 5.1.0.2348 build_20230325 | Vulnerable | QNAP |
| cpe:2.3:o:qnap:qts:5.1.0.2399:build_20230515:*:*:*:*:*:* | 5.1.0.2399 build_20230515 | Vulnerable | QNAP |
| cpe:2.3:o:qnap:qts:5.1.0.2418:build_20230603:*:*:*:*:*:* | 5.1.0.2418 build_20230603 | Vulnerable | QNAP |
| cpe:2.3:o:qnap:qts:5.1.0.2444:build_20230629:*:*:*:*:*:* | 5.1.0.2444 build_20230629 | Vulnerable | QNAP |
| cpe:2.3:o:qnap:qts:5.1.0.2466:build_20230721:*:*:*:*:*:* | 5.1.0.2466 build_20230721 | Vulnerable | QNAP |
| cpe:2.3:o:qnap:qts:5.1.1.2491:build_20230815:*:*:*:*:*:* | 5.1.1.2491 build_20230815 | Vulnerable | QNAP |
| cpe:2.3:o:qnap:qts:5.0.1.2034:build_20220515:*:*:*:*:*:* | 5.0.1.2034 build_20220515 | Vulnerable | QNAP |
| cpe:2.3:o:qnap:qts:5.0.1.2079:build_20220629:*:*:*:*:*:* | 5.0.1.2079 build_20220629 | Vulnerable | QNAP |
| cpe:2.3:o:qnap:qts:5.0.1.2131:build_20220820:*:*:*:*:*:* | 5.0.1.2131 build_20220820 | Vulnerable | QNAP |
| cpe:2.3:o:qnap:qts:5.0.1.2137:build_20220826:*:*:*:*:*:* | 5.0.1.2137 build_20220826 | Vulnerable | QNAP |
- cpe:2.3:o:qnap:qts:5.1.0.2348:build_20230325:*:*:*:*:*:* Versions 5.1.0.2348 build_20230325 Vulnerable ·QNAP
- cpe:2.3:o:qnap:qts:5.1.0.2399:build_20230515:*:*:*:*:*:* Versions 5.1.0.2399 build_20230515 Vulnerable ·QNAP
- cpe:2.3:o:qnap:qts:5.1.0.2418:build_20230603:*:*:*:*:*:* Versions 5.1.0.2418 build_20230603 Vulnerable ·QNAP
- cpe:2.3:o:qnap:qts:5.1.0.2444:build_20230629:*:*:*:*:*:* Versions 5.1.0.2444 build_20230629 Vulnerable ·QNAP
- cpe:2.3:o:qnap:qts:5.1.0.2466:build_20230721:*:*:*:*:*:* Versions 5.1.0.2466 build_20230721 Vulnerable ·QNAP
- cpe:2.3:o:qnap:qts:5.1.1.2491:build_20230815:*:*:*:*:*:* Versions 5.1.1.2491 build_20230815 Vulnerable ·QNAP
- cpe:2.3:o:qnap:qts:5.0.1.2034:build_20220515:*:*:*:*:*:* Versions 5.0.1.2034 build_20220515 Vulnerable ·QNAP
- cpe:2.3:o:qnap:qts:5.0.1.2079:build_20220629:*:*:*:*:*:* Versions 5.0.1.2079 build_20220629 Vulnerable ·QNAP
- cpe:2.3:o:qnap:qts:5.0.1.2131:build_20220820:*:*:*:*:*:* Versions 5.0.1.2131 build_20220820 Vulnerable ·QNAP
- cpe:2.3:o:qnap:qts:5.0.1.2137:build_20220826:*:*:*:*:*:* Versions 5.0.1.2137 build_20220826 Vulnerable ·QNAP
Show 21 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:qnap:qts:5.0.1.2145:build_20220903:*:*:*:*:*:* | 5.0.1.2145 build_20220903 | Vulnerable | QNAP |
| cpe:2.3:o:qnap:qts:5.0.1.2173:build_20221001:*:*:*:*:*:* | 5.0.1.2173 build_20221001 | Vulnerable | QNAP |
| cpe:2.3:o:qnap:qts:5.0.1.2194:build_20221022:*:*:*:*:*:* | 5.0.1.2194 build_20221022 | Vulnerable | QNAP |
| cpe:2.3:o:qnap:qts:5.0.1.2234:build_20221201:*:*:*:*:*:* | 5.0.1.2234 build_20221201 | Vulnerable | QNAP |
| cpe:2.3:o:qnap:qts:5.0.1.2248:build_20221215:*:*:*:*:*:* | 5.0.1.2248 build_20221215 | Vulnerable | QNAP |
| cpe:2.3:o:qnap:qts:5.0.1.2277:build_20230112:*:*:*:*:*:* | 5.0.1.2277 build_20230112 | Vulnerable | QNAP |
| cpe:2.3:o:qnap:qts:5.0.1.2346:build_20230322:*:*:*:*:*:* | 5.0.1.2346 build_20230322 | Vulnerable | QNAP |
| cpe:2.3:o:qnap:qts:5.0.1.2376:build_20230421:*:*:*:*:*:* | 5.0.1.2376 build_20230421 | Vulnerable | QNAP |
| cpe:2.3:o:qnap:qts:5.0.1.2425:build_20230609:*:*:*:*:*:* | 5.0.1.2425 build_20230609 | Vulnerable | QNAP |
| cpe:2.3:o:qnap:quts_hero:h5.1.0.2409:build_20230525:*:*:*:*:*:* | h5.1.0.2409 build_20230525 | Vulnerable | QNAP |
| cpe:2.3:o:qnap:quts_hero:h5.1.0.2424:build_20230609:*:*:*:*:*:* | h5.1.0.2424 build_20230609 | Vulnerable | QNAP |
| cpe:2.3:o:qnap:quts_hero:h5.1.0.2453:build_20230708:*:*:*:*:*:* | h5.1.0.2453 build_20230708 | Vulnerable | QNAP |
| cpe:2.3:o:qnap:quts_hero:h5.1.0.2466:build_20230721:*:*:*:*:*:* | h5.1.0.2466 build_20230721 | Vulnerable | QNAP |
| cpe:2.3:o:qnap:quts_hero:h5.1.1.2488:build_20230812:*:*:*:*:*:* | h5.1.1.2488 build_20230812 | Vulnerable | QNAP |
| cpe:2.3:o:qnap:quts_hero:h5.0.1.2045:build_20220526:*:*:*:*:*:* | h5.0.1.2045 build_20220526 | Vulnerable | QNAP |
| cpe:2.3:o:qnap:quts_hero:h5.0.1.2192:build_20221020:*:*:*:*:*:* | h5.0.1.2192 build_20221020 | Vulnerable | QNAP |
| cpe:2.3:o:qnap:quts_hero:h5.0.1.2248:build_20221215:*:*:*:*:*:* | h5.0.1.2248 build_20221215 | Vulnerable | QNAP |
| cpe:2.3:o:qnap:quts_hero:h5.0.1.2269:build_20230104:*:*:*:*:*:* | h5.0.1.2269 build_20230104 | Vulnerable | QNAP |
| cpe:2.3:o:qnap:quts_hero:h5.0.1.2277:build_20230112:*:*:*:*:*:* | h5.0.1.2277 build_20230112 | Vulnerable | QNAP |
| cpe:2.3:o:qnap:quts_hero:h5.0.1.2348:build_20230324:*:*:*:*:*:* | h5.0.1.2348 build_20230324 | Vulnerable | QNAP |
| cpe:2.3:o:qnap:quts_hero:h5.0.1.2376:build_20230421:*:*:*:*:*:* | h5.0.1.2376 build_20230421 | Vulnerable | QNAP |
- cpe:2.3:o:qnap:qts:5.0.1.2145:build_20220903:*:*:*:*:*:* Versions 5.0.1.2145 build_20220903 Vulnerable ·QNAP
- cpe:2.3:o:qnap:qts:5.0.1.2173:build_20221001:*:*:*:*:*:* Versions 5.0.1.2173 build_20221001 Vulnerable ·QNAP
- cpe:2.3:o:qnap:qts:5.0.1.2194:build_20221022:*:*:*:*:*:* Versions 5.0.1.2194 build_20221022 Vulnerable ·QNAP
- cpe:2.3:o:qnap:qts:5.0.1.2234:build_20221201:*:*:*:*:*:* Versions 5.0.1.2234 build_20221201 Vulnerable ·QNAP
- cpe:2.3:o:qnap:qts:5.0.1.2248:build_20221215:*:*:*:*:*:* Versions 5.0.1.2248 build_20221215 Vulnerable ·QNAP
- cpe:2.3:o:qnap:qts:5.0.1.2277:build_20230112:*:*:*:*:*:* Versions 5.0.1.2277 build_20230112 Vulnerable ·QNAP
- cpe:2.3:o:qnap:qts:5.0.1.2346:build_20230322:*:*:*:*:*:* Versions 5.0.1.2346 build_20230322 Vulnerable ·QNAP
- cpe:2.3:o:qnap:qts:5.0.1.2376:build_20230421:*:*:*:*:*:* Versions 5.0.1.2376 build_20230421 Vulnerable ·QNAP
- cpe:2.3:o:qnap:qts:5.0.1.2425:build_20230609:*:*:*:*:*:* Versions 5.0.1.2425 build_20230609 Vulnerable ·QNAP
- cpe:2.3:o:qnap:quts_hero:h5.1.0.2409:build_20230525:*:*:*:*:*:* Versions h5.1.0.2409 build_20230525 Vulnerable ·QNAP
- cpe:2.3:o:qnap:quts_hero:h5.1.0.2424:build_20230609:*:*:*:*:*:* Versions h5.1.0.2424 build_20230609 Vulnerable ·QNAP
- cpe:2.3:o:qnap:quts_hero:h5.1.0.2453:build_20230708:*:*:*:*:*:* Versions h5.1.0.2453 build_20230708 Vulnerable ·QNAP
- cpe:2.3:o:qnap:quts_hero:h5.1.0.2466:build_20230721:*:*:*:*:*:* Versions h5.1.0.2466 build_20230721 Vulnerable ·QNAP
- cpe:2.3:o:qnap:quts_hero:h5.1.1.2488:build_20230812:*:*:*:*:*:* Versions h5.1.1.2488 build_20230812 Vulnerable ·QNAP
- cpe:2.3:o:qnap:quts_hero:h5.0.1.2045:build_20220526:*:*:*:*:*:* Versions h5.0.1.2045 build_20220526 Vulnerable ·QNAP
- cpe:2.3:o:qnap:quts_hero:h5.0.1.2192:build_20221020:*:*:*:*:*:* Versions h5.0.1.2192 build_20221020 Vulnerable ·QNAP
- cpe:2.3:o:qnap:quts_hero:h5.0.1.2248:build_20221215:*:*:*:*:*:* Versions h5.0.1.2248 build_20221215 Vulnerable ·QNAP
- cpe:2.3:o:qnap:quts_hero:h5.0.1.2269:build_20230104:*:*:*:*:*:* Versions h5.0.1.2269 build_20230104 Vulnerable ·QNAP
- cpe:2.3:o:qnap:quts_hero:h5.0.1.2277:build_20230112:*:*:*:*:*:* Versions h5.0.1.2277 build_20230112 Vulnerable ·QNAP
- cpe:2.3:o:qnap:quts_hero:h5.0.1.2348:build_20230324:*:*:*:*:*:* Versions h5.0.1.2348 build_20230324 Vulnerable ·QNAP
- cpe:2.3:o:qnap:quts_hero:h5.0.1.2376:build_20230421:*:*:*:*:*:* Versions h5.0.1.2376 build_20230421 Vulnerable ·QNAP
Remediation
- Fix · CNA QTS (QNAP Systems Inc.) Fixed in 5.0.1.2514 build 20230906, 5.1.2.2533 build 20230926
- Fix · CNA QuTS hero (QNAP Systems Inc.) Fixed in h5.0.1.2515 build 20230907, h5.1.2.2534 build 20230927
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
QNAP Systems QTS, QuTS hero 5.0.1.2514 build 20230906, 5.1.2.2533 build 20230926 and 2 more versions
2 records Highest priority Priority LOW 2 LOW
Other records, highest priority first
- TI-2023-16156 Buffer overflow in QNAP QTSPriority LOW 33
Timeline
- 2026-10-02 Threatist record created from CVE-2023-32975
- 2026-10-03 Alias added: GHSA-cjp2-5mj8-82hm
References
More QNAP Qts vulnerabilities
- TI-2020-02221 Command Injection Vulnerability in QTS and QuTS hero KEVCVSS 3.1CRITICAL 9.8
- TI-2019-05101 Improper input validation in QNAP NAS devices KEVCVSS 3.1CRITICAL 9.8
- TI-2018-14137 Improper input validation in QNAP QTS KEVCVSS 3.1CRITICAL 9.8
- TI-2014-05975 GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed… KEVCVSS 3.1CRITICAL 9.8
- TI-2014-05157 GNU Bash through 4.3 processes trailing strings after function definitions in the values… KEVCVSS 3.1CRITICAL 9.8
- TI-2018-14131 Cross-site scripting in QNAP QTS KEVCVSS 3.1HIGH 8.0
Sources
- CVE-2023-32975 · CVE Program
- CVE-2023-32975 · NVD
- FIRST EPSS
- GHSA-cjp2-5mj8-82hm · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences