Buffer overflow in QNAP Systems, Inc. products - CVE-2023-32973
Published: October 16, 2023
Vulnerability identifier: #VU82021
CSH Severity: Low
CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2023-32973
CWE-ID: CWE-119
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to execute arbitrary code on the target system.
The vulnerability exists due to a boundary error. A remote administrator can trigger memory corruption and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
Affected software
QuTScloud
QuTS hero
QNAP QTS
QuTS hero
QNAP QTS
How to mitigate CVE-2023-32973
Install update from vendor's website.
QuTScloud - update to c5.1.0.2498
QuTS hero - addressed in versions h4.5.4.2476 build 20230728, h5.0.1.2515 build 20230907, h5.1.0.2424 build 20230609
QNAP QTS - addressed in versions 4.5.4.2467 20230718, 5.0.1.2425 20230609, 5.1.0.2444 20230629
QuTS hero - addressed in versions h4.5.4.2476 build 20230728, h5.0.1.2515 build 20230907, h5.1.0.2424 build 20230609
QNAP QTS - addressed in versions 4.5.4.2467 20230718, 5.0.1.2425 20230609, 5.1.0.2444 20230629