CVE-2023-39298: QTS, QuTS hero | LiveThreat CVE Feed

Description

A missing authorization vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow local authenticated users to access data or perform actions that they should not be allowed to perform via unspecified vectors. QuTScloud, is not affected. We have already fixed the vulnerability in the following versions: QTS 5.2.0.2737 build 20240417 and later QuTS hero h5.2.0.2782 build 20240601 and later

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack vector

Local

Complexity

Low

Privileges

Low

User interaction

None

Confidentiality

High

Integrity

High

Availability

High

Scope

Unchanged

Exploitation

Is it being used?

Exploit prediction (EPSS)0.1% · higher than 3% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

QT

QTS · QNAP Systems Inc.

5.1.x before 5.2.0.2737 build 20240417 · source: vendor, NVD, CISA

QH

QuTS hero · QNAP Systems Inc.

h5.1.x before h5.2.0.2782 build 20240601 · source: vendor, NVD, CISA

QU

Qutscloud · Qnap

c5.0.0 before h5.2.0.2782 · source: CISA