SB2025031064 - Multiple vulnerabilities in QNAP QTS and QuTS hero

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2025031064

SB2025031064 - Multiple vulnerabilities in QNAP QTS and QuTS hero

Published: March 10, 2025

Security Bulletin ID SB2025031064
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 6
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

Medium 17% Low 83%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 6 vulnerabilities.


1) CRLF injection (CVE-ID: CVE-2024-50405)

CWE-ID: CWE-93 - Improper Neutralization of CRLF Sequences ('CRLF Injection')

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a remote user to inject arbitrary data in server response.

The vulnerability exists due to insufficient validation of attacker-supplied data. A remote administrator can pass specially crafted data to the application containing CR-LF characters and modify application behavior.


2) OS Command Injection (CVE-ID: CVE-2024-53692)

CWE-ID: CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a remote user to execute arbitrary shell commands on the target system.

The vulnerability exists due to improper input validation. A remote administrator can pass specially crafted data to the application and execute arbitrary OS commands on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.


3) CRLF injection (CVE-ID: CVE-2024-53693)

CWE-ID: CWE-93 - Improper Neutralization of CRLF Sequences ('CRLF Injection')

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote attacker to inject arbitrary data in server response.

The vulnerability exists due to insufficient validation of attacker-supplied data. A remote user can pass specially crafted data to the application containing CR-LF characters and modify application behavior.


4) Out-of-bounds write (CVE-ID: CVE-2024-53697)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a remote user to compromise vulnerable system.

The vulnerability exists due to a boundary error when processing untrusted input. A remote administrator can trigger an out-of-bounds write and execute arbitrary code on the target system.


5) Out-of-bounds write (CVE-ID: CVE-2024-53699)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a remote user to compromise vulnerable system.

The vulnerability exists due to a boundary error when processing untrusted input. A remote administrator can trigger an out-of-bounds write and execute arbitrary code on the target system.


6) Double free (CVE-ID: CVE-2024-53698)

CWE-ID: CWE-415 - Double Free

CVSSv4: CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a remote user to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error. A remote administrator can pass specially crafted data to the application, trigger double free error, modify memory and execute arbitrary code on the target system.


Remediation

Install update from vendor's website.

References