QNAP QuTS hero SSRF Vulnerability (QSA-24-53)

QNAP QuTS hero is prone to a server-side request forgery SSRF vulnerability. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

CVE-2024-38638

An out-of-bounds write vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote attackers who have gained administrator access to modify or corrupt memory. QTS 5.2.x/QuTS hero h5.2.x are not affected. We have already fixe...

CVE-2024-13086

An exposure of sensitive information vulnerability has been reported to affect product. If exploited, the vulnerability could allow remote attackers to compromise the security of the system. We have already fixed the vulnerability in the following version: QTS 5.2.0.2851 build 20240808 and later...

CVE-2024-53697

An out-of-bounds write vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote attackers who have gained administrator access to modify or corrupt memory. We have already fixed the vulnerability in the following versions...

CVE-2024-53696

A server-side request forgery SSRF vulnerability has been reported to affect QuLog Center. If exploited, the vulnerability could allow remote attackers who have gained administrator access to read application data. We have already fixed the vulnerability in the following versions: QuLog Center...

CVE-2024-53698

A double free vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote attackers who have gained administrator access to modify memory. We have already fixed the vulnerability in the following versions: QTS 5.2.3.3006 bui...

CVE-2024-53699

An out-of-bounds write vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote attackers who have gained administrator access to modify or corrupt memory. We have already fixed the vulnerability in the following versions...

CVE-2024-50405

An improper neutralization of CRLF sequences 'CRLF Injection' vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote attackers who have gained administrator access to modify application data. We have already fixed the...

CVE-2024-13086

An exposure of sensitive information vulnerability has been reported to affect product. If exploited, the vulnerability could allow remote attackers to compromise the security of the system. We have already fixed the vulnerability in the following version: QTS 5.2.0.2851 build 20240808 and later...

CVE-2024-53699 QTS, QuTS hero

An out-of-bounds write vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote attackers who have gained administrator access to modify or corrupt memory. We have already fixed the vulnerability in the following versions...

CVE-2024-53697

CVE-2024-53697 is an out-of-bounds write vulnerability affecting QNAP QTS and QuTS hero. The issue allows memory modification/corruption when exploited by remote attackers who have gained administrator access. The advisory notes a fix in QTS 5.2.3.3006 build 20250108 and later and QuTS hero h5.2....

CVE-2024-50405 QTS, QuTS hero

An improper neutralization of CRLF sequences 'CRLF Injection' vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote attackers who have gained administrator access to modify application data. We have already fixed the...

CVE-2024-13086 QTS, QuTS hero

An exposure of sensitive information vulnerability has been reported to affect product. If exploited, the vulnerability could allow remote attackers to compromise the security of the system. We have already fixed the vulnerability in the following version: QTS 5.2.0.2851 build 20240808 and later...

CVE-2024-13086

CVE-2024-13086 affects QNAP QTS and QuTS hero (pre-5.2.0.2851 build 20240808 and earlier). It is described as an exposure of sensitive information that could let remote attackers compromise system security. The vulnerability has been fixed in QTS 5.2.0.2851 build 20240808 and later, and QuTS hero...

CVE-2024-13086 QTS, QuTS hero

An exposure of sensitive information vulnerability has been reported to affect product. If exploited, the vulnerability could allow remote attackers to compromise the security of the system. We have already fixed the vulnerability in the following version: QTS 5.2.0.2851 build 20240808 and later...

PT-2025-10106

Name of the Vulnerable Software and Affected Versions QNAP QTS versions prior to 5.2.3.3006 build 20250108 QNAP QuTS hero versions prior to h5.2.3.3006 build 20250108 Description An improper neutralization of CRLF sequences, also known as 'CRLF Injection', has been reported. This issue could allo...

PT-2025-10112

Name of the Vulnerable Software and Affected Versions QNAP QTS versions prior to 5.2.3.3006 build 20250108 QNAP QuTS hero versions prior to 5.2.3.3006 build 20250108 Description An out-of-bounds write issue has been reported, potentially allowing remote attackers with administrator access to modi...

CVE-2024-53692: Improper Neutralization of Special Elements used in a Command

A command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote attackers who have gained administrator access to execute arbitrary commands. We have already fixed the vulnerability in the following versions:...

QNAP Systems QTS和QNAP Systems QuTS hero 操作系统命令注入漏洞

QNAP QTS is a Linux-based NAS operating system launched by QNAP, providing an intuitive and easy-to-use graphical interface and powerful data management features. QNAP QuTS hero is an operating system launched by QNAP specifically for enterprise-level applications, adopting the ZFS file system,...

QNAP Systems QTS和QNAP Systems QuTS hero 缓冲区错误漏洞

QNAP QTS is a Linux-based NAS operating system launched by QNAP, providing an intuitive and easy-to-use graphical interface and powerful data management features. QNAP QuTS hero is an operating system launched by QNAP specifically for enterprise-level applications, adopting the ZFS file system,...