CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
HIGH
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
AI Score
Confidence
High
EPSS
Percentile
16.0%
An incorrect authorization vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated users to bypass intended access restrictions via a network.
QTS 5.x, QuTS hero are not affected.
We have already fixed the vulnerability in the following versions:
QuTScloud c5.1.5.2651 and later
QTS 4.5.4.2627 build 20231225 and later
Vendor | Product | Version | CPE |
---|---|---|---|
qnap | qts | 4.5.4.1715 | cpe:2.3:o:qnap:qts:4.5.4.1715:build_20210630:*:*:*:*:*:* |
qnap | qts | 4.5.4.1723 | cpe:2.3:o:qnap:qts:4.5.4.1723:build_20210708:*:*:*:*:*:* |
qnap | qts | 4.5.4.1741 | cpe:2.3:o:qnap:qts:4.5.4.1741:build_20210726:*:*:*:*:*:* |
qnap | qts | 4.5.4.1787 | cpe:2.3:o:qnap:qts:4.5.4.1787:build_20210910:*:*:*:*:*:* |
qnap | qts | 4.5.4.1800 | cpe:2.3:o:qnap:qts:4.5.4.1800:build_20210923:*:*:*:*:*:* |
qnap | qts | 4.5.4.1892 | cpe:2.3:o:qnap:qts:4.5.4.1892:build_20211223:*:*:*:*:*:* |
qnap | qts | 4.5.4.1931 | cpe:2.3:o:qnap:qts:4.5.4.1931:build_20220128:*:*:*:*:*:* |
qnap | qts | 4.5.4.2012 | cpe:2.3:o:qnap:qts:4.5.4.2012:build_20220419:*:*:*:*:*:* |
qnap | qts | 4.5.4.2117 | cpe:2.3:o:qnap:qts:4.5.4.2117:build_20220802:*:*:*:*:*:* |
qnap | qts | 4.5.4.2280 | cpe:2.3:o:qnap:qts:4.5.4.2280:build_20230112:*:*:*:*:*:* |
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
HIGH
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
AI Score
Confidence
High
EPSS
Percentile
16.0%