Read the docs
TI-2024-24586 Aliases CVE-2024-37048GHSA-2cw9-wr8h-2pwh

NULL pointer dereference in QNAP QTS

Priority LOW 24CWE-476Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Denial of service
Confidentiality · integrity · availability
None · Low · Low
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-476.

Summary

A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote attackers who have gained administrator access to launch a denial-of-service (DoS) attack. We have already fixed the vulnerability in the following versions: QTS 5.2.1.2930 build 20241025 and later QuTS hero h5.2.1.2929 build 20241025 and later

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00634 50th percentileScored 2026-11-07
Fix Fixed QTS (QNAP Systems Inc.): 5.2.1.2930 build 20241025QuTS hero (QNAP Systems Inc.): h5.2.1.2929 build 20241025

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
QNAPQTS5.2.x to before 5.2.1.2930 build 202410255.2.1.2930 build 20241025Patch availableCNA
QNAPQuTS heroh5.2.x to before h5.2.1.2929 build 20241025h5.2.1.2929 build 20241025Patch availableCNA
  • QTS VendorQNAP Affected 5.2.x to before 5.2.1.2930 build 20241025 Fixed in 5.2.1.2930 build 20241025 Patch available CNA
  • QuTS hero VendorQNAP Affected h5.2.x to before h5.2.1.2929 build 20241025 Fixed in h5.2.1.2929 build 20241025 Patch available CNA

CPE configurations NVD · 14

CPEVersionsRoleVendor
cpe:2.3:o:qnap:qts:5.2.0.2737:build_20240417:*:*:*:*:*:*5.2.0.2737 build_20240417VulnerableQNAP
cpe:2.3:o:qnap:qts:5.2.0.2744:build_20240424:*:*:*:*:*:*5.2.0.2744 build_20240424VulnerableQNAP
cpe:2.3:o:qnap:qts:5.2.0.2782:build_20240601:*:*:*:*:*:*5.2.0.2782 build_20240601VulnerableQNAP
cpe:2.3:o:qnap:qts:5.2.0.2802:build_20240620:*:*:*:*:*:*5.2.0.2802 build_20240620VulnerableQNAP
cpe:2.3:o:qnap:qts:5.2.0.2823:build_20240711:*:*:*:*:*:*5.2.0.2823 build_20240711VulnerableQNAP
cpe:2.3:o:qnap:qts:5.2.0.2851:build_20240808:*:*:*:*:*:*5.2.0.2851 build_20240808VulnerableQNAP
cpe:2.3:o:qnap:qts:5.2.0.2860:build_20240817:*:*:*:*:*:*5.2.0.2860 build_20240817VulnerableQNAP
cpe:2.3:o:qnap:quts_hero:h5.2.0.2737:build_20240417:*:*:*:*:*:*h5.2.0.2737 build_20240417VulnerableQNAP
cpe:2.3:o:qnap:quts_hero:h5.2.0.2782:build_20240601:*:*:*:*:*:*h5.2.0.2782 build_20240601VulnerableQNAP
cpe:2.3:o:qnap:quts_hero:h5.2.0.2789:build_20240607:*:*:*:*:*:*h5.2.0.2789 build_20240607VulnerableQNAP
  • cpe:2.3:o:qnap:qts:5.2.0.2737:build_20240417:*:*:*:*:*:* Versions 5.2.0.2737 build_20240417 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:5.2.0.2744:build_20240424:*:*:*:*:*:* Versions 5.2.0.2744 build_20240424 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:5.2.0.2782:build_20240601:*:*:*:*:*:* Versions 5.2.0.2782 build_20240601 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:5.2.0.2802:build_20240620:*:*:*:*:*:* Versions 5.2.0.2802 build_20240620 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:5.2.0.2823:build_20240711:*:*:*:*:*:* Versions 5.2.0.2823 build_20240711 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:5.2.0.2851:build_20240808:*:*:*:*:*:* Versions 5.2.0.2851 build_20240808 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:5.2.0.2860:build_20240817:*:*:*:*:*:* Versions 5.2.0.2860 build_20240817 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:quts_hero:h5.2.0.2737:build_20240417:*:*:*:*:*:* Versions h5.2.0.2737 build_20240417 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:quts_hero:h5.2.0.2782:build_20240601:*:*:*:*:*:* Versions h5.2.0.2782 build_20240601 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:quts_hero:h5.2.0.2789:build_20240607:*:*:*:*:*:* Versions h5.2.0.2789 build_20240607 Vulnerable ·QNAP
Show 4 more CPE
CPEVersionsRoleVendor
cpe:2.3:o:qnap:quts_hero:h5.2.0.2802:build_20240620:*:*:*:*:*:*h5.2.0.2802 build_20240620VulnerableQNAP
cpe:2.3:o:qnap:quts_hero:h5.2.0.2823:build_20240711:*:*:*:*:*:*h5.2.0.2823 build_20240711VulnerableQNAP
cpe:2.3:o:qnap:quts_hero:h5.2.0.2851:build_20240808:*:*:*:*:*:*h5.2.0.2851 build_20240808VulnerableQNAP
cpe:2.3:o:qnap:quts_hero:h5.2.0.2860:build_20240817:*:*:*:*:*:*h5.2.0.2860 build_20240817VulnerableQNAP
  • cpe:2.3:o:qnap:quts_hero:h5.2.0.2802:build_20240620:*:*:*:*:*:* Versions h5.2.0.2802 build_20240620 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:quts_hero:h5.2.0.2823:build_20240711:*:*:*:*:*:* Versions h5.2.0.2823 build_20240711 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:quts_hero:h5.2.0.2851:build_20240808:*:*:*:*:*:* Versions h5.2.0.2851 build_20240808 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:quts_hero:h5.2.0.2860:build_20240817:*:*:*:*:*:* Versions h5.2.0.2860 build_20240817 Vulnerable ·QNAP

Remediation

  • Fix · CNA QTS (QNAP Systems Inc.) Fixed in 5.2.1.2930 build 20241025
  • Fix · CNA QuTS hero (QNAP Systems Inc.) Fixed in h5.2.1.2929 build 20241025

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    QNAP Systems QTS, QuTS hero 5.2.1.2930 build 20241025, h5.2.1.2929 build 20241025

    16 records Highest priority Priority LOW 16 LOW

    Other records, highest priority first

    • TI-2024-33830 A use of externally-controlled format string vulnerability has been reported to affect…Priority LOW 35
    • TI-2024-33829 A use of externally-controlled format string vulnerability has been reported to affect…Priority LOW 35
    • TI-2024-24588 Buffer overflow in QNAP QTSPriority LOW 25
    Show all 16 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-37048
  2. 2026-10-03 Alias added: GHSA-2cw9-wr8h-2pwh
  3. 2026-10-25 EPSS moved to the 50th–90th percentile

References

Advisory 1

  • TI-2020-02221 Command Injection Vulnerability in QTS and QuTS hero KEVCVSS 3.1CRITICAL 9.8
  • TI-2019-05101 Improper input validation in QNAP NAS devices KEVCVSS 3.1CRITICAL 9.8
  • TI-2018-14137 Improper input validation in QNAP QTS KEVCVSS 3.1CRITICAL 9.8
  • TI-2014-05975 GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed… KEVCVSS 3.1CRITICAL 9.8
  • TI-2014-05157 GNU Bash through 4.3 processes trailing strings after function definitions in the values… KEVCVSS 3.1CRITICAL 9.8
  • TI-2018-14131 Cross-site scripting in QNAP QTS KEVCVSS 3.1HIGH 8.0
See all 282 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences