CVE-2023-45036
QTS, QuTS hero, QuTScloud
Reported by qnap · Published February 2, 2024
A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated administrators to execute code via a network. We have already fixed the vulnerability in the following versions: QTS 5.1.3.2578 build 20231110 and later QuTS hero h5.1.3.2578 build 20231110 and later QuTScloud c5.1.5.2651 and later
Fixed versions
Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.
| Package | Ecosystem | Fixed in |
|---|---|---|
| QuTS hero | QNAP Systems Inc. | h5.1.3.2578 build 20231110 |
| QuTScloud | QNAP Systems Inc. | c5.1.5.2651 |
| QTS | QNAP Systems Inc. | 5.1.3.2578 build 20231110 |
Risk scores
Affected products
| Vendor | Product | Versions |
|---|---|---|
| QNAP Systems Inc. | QTS | 5.1.x |
| QNAP Systems Inc. | QuTS hero | h5.1.x |
| QNAP Systems Inc. | QuTScloud | c5.x.x |
| QNAP Systems Inc. | QuTScloud | * |
| QNAP Systems Inc. | QTS | 5.1.x |
| QNAP Systems Inc. | QuTS hero | 5.1.x |
Timeline
- Feb 2, 2024 CVE Published
- Feb 8, 2024 EPSS Score (30 in total, the first dated here)
- Feb 25, 2024 PoC Published
- May 8, 2026 Security Advisory
- Aug 2, 2026 Coalition ESS Score
Query this with the API
The same record, from the CLI:
vulnetix vdb vuln CVE-2023-45036
vulnetix vdb fixes CVE-2023-45036Or with curl, using the org id and key from your account page:
curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
"https://api.vdb.vulnetix.com/v2/vuln/CVE-2023-45036/fixes/registry"The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart