Lucene search

QnapVULNRICHMENT:CVE-2024-32765

HistoryAug 09, 2024 - 5:09 p.m.

CVE-2024-32765 QTS, QuTS hero

2024-08-0917:09:46

CWE-306

CWE-291

qnap

github.com

cve-2024-32765

vulnerability

network & virtual switch

local authenticated administrators

functions

unspecified vectors

qts

quts hero

CVSS3

4.2

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L

AI Score

Confidence

Low

EPSS

0.001

Percentile

29.6%

SSVC

Exploitation

none

Automatable

Technical Impact

partial

JSON

A vulnerability has been reported to affect Network & Virtual Switch. If exploited, the vulnerability could allow local authenticated administrators to gain access to and execute certain functions via unspecified vectors.

We have already fixed the vulnerability in the following versions:
QTS 5.1.8.2823 build 20240712 and later
QuTS hero h5.1.8.2823 build 20240712 and later

CNA Affected

[
  {
    "vendor": "QNAP Systems Inc.",
    "product": "QTS",
    "versions": [
      {
        "status": "affected",
        "version": "5.1.x",
        "lessThan": "5.1.8.2823 build 20240712",
        "versionType": "custom"
      }
    ],
    "defaultStatus": "unaffected"
  },
  {
    "vendor": "QNAP Systems Inc.",
    "product": "QuTS hero",
    "versions": [
      {
        "status": "affected",
        "version": "h5.1.x",
        "lessThan": "h5.1.8.2823 build 20240712",
        "versionType": "custom"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

References

www.qnap.com/en/security-advisory/qsa-24-14