Read the docs
TI-2023-17461 Aliases CVE-2023-34971GHSA-8f9x-x39g-28fc

An inadequate encryption strength vulnerability has been reported to affect QNAP…

Priority LOW 39CWE-326Published · Updated

Key facts

Attack vector
Adjacent network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-326.

Summary

An inadequate encryption strength vulnerability has been reported to affect QNAP operating systems. If exploited, the vulnerability possibly allows local network clients to decrypt the data using brute force attacks via unspecified vectors. We have already fixed the vulnerability in the following versions: QTS 5.0.1.2425 build 20230609 and later QTS 5.1.0.2444 build 20230629 and later QTS 4.5.4.2467 build 20230718 and later QuTS hero h5.1.0.2424 build 20230609 and later QuTS hero h4.5.4.2476 build 20230728 and later

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00103 0th percentileScored 2026-11-07
Fix Fixed QTS (QNAP Systems Inc.): 5.0.1.2425 build 20230609, 5.1.0.2444 build 20230629, 4.5.4.2467 build 20230718QuTS hero (QNAP Systems Inc.): h5.1.0.2424 build 20230609, h4.5.4.2476 build 20230728

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
QNAPQTSbefore 5.0.1.2425 build 20230609; before 5.1.0.2444 build 20230629; before 4.5.4.2467 build 202307185.0.1.2425 build 20230609, 5.1.0.2444 build 20230629, 4.5.4.2467 build 20230718Patch availableCNA
QNAPQuTS herobefore h5.1.0.2424 build 20230609; before h4.5.4.2476 build 20230728h5.1.0.2424 build 20230609, h4.5.4.2476 build 20230728Patch availableCNA
  • QTS VendorQNAP Affected before 5.0.1.2425 build 20230609; before 5.1.0.2444 build 20230629; before 4.5.4.2467 build 20230718 Fixed in 5.0.1.2425 build 20230609, 5.1.0.2444 build 20230629, 4.5.4.2467 build 20230718 Patch available CNA
  • QuTS hero VendorQNAP Affected before h5.1.0.2424 build 20230609; before h4.5.4.2476 build 20230728 Fixed in h5.1.0.2424 build 20230609, h4.5.4.2476 build 20230728 Patch available CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:o:qnap:qts:*:*:*:*:*:*:*:*4.5.4 to before 4.5.4.2467; 5.0.1 to before 5.0.1.2425; 5.1.0 to before 5.1.0.2444VulnerableQNAP
cpe:2.3:o:qnap:quts_hero:*:*:*:*:*:*:*:*h4.5.4 to before h4.5.4.2476; h5.1.0 to before h5.1.0.2424VulnerableQNAP
  • cpe:2.3:o:qnap:qts:*:*:*:*:*:*:*:* Versions 4.5.4 to before 4.5.4.2467; 5.0.1 to before 5.0.1.2425; 5.1.0 to before 5.1.0.2444 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:quts_hero:*:*:*:*:*:*:*:* Versions h4.5.4 to before h4.5.4.2476; h5.1.0 to before h5.1.0.2424 Vulnerable ·QNAP

Remediation

  • Fix · CNA QTS (QNAP Systems Inc.) Fixed in 5.0.1.2425 build 20230609, 5.1.0.2444 build 20230629, 4.5.4.2467 build 20230718
  • Fix · CNA QuTS hero (QNAP Systems Inc.) Fixed in h5.1.0.2424 build 20230609, h4.5.4.2476 build 20230728

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-34971
  2. 2026-10-03 Alias added: GHSA-8f9x-x39g-28fc

References

Advisory 1

  • TI-2020-02221 Command Injection Vulnerability in QTS and QuTS hero KEVCVSS 3.1CRITICAL 9.8
  • TI-2019-05101 Improper input validation in QNAP NAS devices KEVCVSS 3.1CRITICAL 9.8
  • TI-2018-14137 Improper input validation in QNAP QTS KEVCVSS 3.1CRITICAL 9.8
  • TI-2014-05975 GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed… KEVCVSS 3.1CRITICAL 9.8
  • TI-2014-05157 GNU Bash through 4.3 processes trailing strings after function definitions in the values… KEVCVSS 3.1CRITICAL 9.8
  • TI-2018-14131 Cross-site scripting in QNAP QTS KEVCVSS 3.1HIGH 8.0
See all 282 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences