by Kastro
Paper/Archive/CVE-2023-39303

CVE-2023-39303

QNAP Systems Inc. QTS — QTS, QuTS hero, QuTScloud

EPSS 0.5%CVSS 9.8
critical.is priorityof 100
38
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 40.6.406 × 208.1No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

An improper authentication vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow users to compromise the security of the system via a network. We have already fixed the vulnerability in the following versions: QTS 5.1.3.2578 build 20231110 and later QuTS hero h5.1.3.2578 build 20231110 and later QuTScloud c5.1.5.2651 and later

Affected

ProductAffectedFixed inSource
QTS5.1.x – < 5.1.3.2578 build 202311105.1.3.2578 build 20231110CNA
QuTS heroh5.1.x – < h5.1.3.2578 build 20231110h5.1.3.2578 build 20231110CNA
QuTScloudc5.x.x – < c5.1.5.2651c5.1.5.2651CNA
qts5.1.0 – < 5.1.3.2578_build 202311105.1.3.2578_build 20231110CISA-ADP
quts_hero5.1.0 – < 5.1.3.2578_build 202311105.1.3.2578_build 20231110CISA-ADP
qutscloud5.0.0 – < 5.1.5.26515.1.5.2651CISA-ADP

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
qnap (CNA)5.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: partial

References

refqnap.com/en/security-advisory/qsa-23-33