United States / Canada - English
Sign out
Security ID : QSA-23-25
Vulnerability in Legacy QTS
Release date : September 22, 2023
CVE identifier : CVE-2023-23363
Affected products: QTS 4.3.6, 4.3.4, 4.3.3, 4.2.6
Severity
High
Status
Resolved
Summary
A buffer copy without checking size of input vulnerability has been reported to affect certain legacy versions of QTS. If exploited, the vulnerability could allow clients to execute code via unspecified vectors.
We have already fixed the vulnerability in the following versions:
- QTS 4.3.6.2441 build 20230621 and later
- QTS 4.3.4.2451 build 20230621 and later
- QTS 4.3.3.2420 build 20230621 and later
- QTS 4.2.6 build 20230621 and later
QTS versions 4.4.x, 4.5.x, and 5.x are not affected. QuTS hero is also not affected.
Recommendation
To secure your device, we recommend regularly updating your system to the latest version to benefit from vulnerability fixes. You can check the product support status to see the latest updates available to your NAS model.
Updating QTS
- Log in to QTS as an administrator.
- Go to Control Panel > System > Firmware Update.
- Under Live Update, click Check for Update.
The system downloads and installs the latest available update.
Tip: You can also download the update from the QNAP website. Go to Support > Download Center and then perform a manual update for your specific device.
Attachment
Acknowledgements: H4lo
Revision History:
V1.0 (September 22, 2023) - Published
