Buffer overflow in QNAP Systems, Inc. products - CVE-2023-32972
Published: October 9, 2023
Vulnerability identifier: #VU81704
CSH Severity: Low
CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2023-32972
CWE-ID: CWE-119
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to execute arbitrary code on the target system.
The vulnerability exists due to a boundary error. A remote administrator can trigger memory corruption and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
Affected software
QuTScloud
QuTS hero
QNAP QTS
QuTS hero
QNAP QTS
How to mitigate CVE-2023-32972
Install updates from vendor's website.
QuTScloud - update to c5.1.0.2498
QuTS hero - addressed in versions h4.5.4.2476 build 20230728, h5.0.1.2515 build 20230907, h5.1.0.2424 build 20230609
QNAP QTS - addressed in versions 4.5.4.2467 20230718, 5.0.1.2425 20230609, 5.1.0.2444 20230629
QuTS hero - addressed in versions h4.5.4.2476 build 20230728, h5.0.1.2515 build 20230907, h5.1.0.2424 build 20230609
QNAP QTS - addressed in versions 4.5.4.2467 20230718, 5.0.1.2425 20230609, 5.1.0.2444 20230629