Headline

CVE-2023-23363: Vulnerability in Legacy QTS - Security Advisory

A buffer copy without checking size of input vulnerability has been reported to affect QNAP operating system. If exploited, the vulnerability possibly allows remote users to execute code via unspecified vectors.

We have already fixed the vulnerability in the following versions: QTS 4.3.6.2441 build 20230621 and later QTS 4.3.3.2420 build 20230621 and later QTS 4.2.6 build 20230621 and later QTS 4.3.4.2451 build 20230621 and later

12 months ago

CVE

Open in Source

#vulnerability #web #js

Security ID : QSA-23-25

Release date : September 22, 2023
CVE identifier : CVE-2023-23363
Affected products: QTS 4.3.6, 4.3.4, 4.3.3, 4.2.6

Summary

A buffer copy without checking size of input vulnerability has been reported to affect certain legacy versions of QTS. If exploited, the vulnerability could allow clients to execute code via unspecified vectors.

We have already fixed the vulnerability in the following versions:

QTS 4.3.6.2441 build 20230621 and later
QTS 4.3.4.2451 build 20230621 and later
QTS 4.3.3.2420 build 20230621 and later
QTS 4.2.6 build 20230621 and later

QTS versions 4.4.x, 4.5.x, and 5.x are not affected. QuTS hero is also not affected.

Recommendation

To secure your device, we recommend regularly updating your system to the latest version to benefit from vulnerability fixes. You can check the product support status to see the latest updates available to your NAS model.

Updating QTS

Log in to QTS as an administrator.
Go to Control Panel > System > Firmware Update.
Under Live Update, click Check for Update.
The system downloads and installs the latest available update.

Tip: You can also download the update from the QNAP website. Go to Support > Download Center and then perform a manual update for your specific device.

Attachment