CVE-2023-41290

QuFirewall

A path traversal vulnerability has been reported to affect QuFirewall. If exploited, the vulnerability could allow authenticated administrators to read the contents of unexpected files and expose sensitive data via a network. We have already fixed the vulnerability in the following version: QuFirewall 2.4.1 ( 2024/02/01 ) and later

CVSS 3.1 · 4.1 Medium EPSS < 1% KEV · Not listed

Vendors

Qnap

Products

Qufirewall

CVE-2023-41291

QuFirewall

A path traversal vulnerability has been reported to affect QuFirewall. If exploited, the vulnerability could allow authenticated administrators to read the contents of unexpected files and expose sensitive data via a network. We have already fixed the vulnerability in the following version: QuFirewall 2.4.1 ( 2024/02/01 ) and later

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Qnap

Products

Qufirewall

CVE-2024-50390

QHora

A command injection vulnerability has been reported to affect QHora. If exploited, the vulnerability could allow remote attackers to execute arbitrary commands. We have already fixed the vulnerability in the following version: QuRouter 2.4.5.032 and later

CVSS 4.0 · 7.7 High EPSS 1.1% KEV · Not listed

Vendors

Qnap

Products

Qurouter

CVE-2024-53700

QHora

A command injection vulnerability has been reported to affect QHora. If exploited, the vulnerability could allow remote attackers who have gained administrator access to execute arbitrary commands. We have already fixed the vulnerability in the following version: QuRouter 2.4.6.028 and later

CVSS 4.0 · 5.1 Medium EPSS 1.2% KEV · Not listed

Vendors

Qnap

Products

Qurouter

CVE-2024-13087

QHora

A command injection vulnerability has been reported to affect QHora. If an attacker gains local network access who have also gained an administrator account, they can then exploit the vulnerability to execute arbitrary commands. We have already fixed the vulnerability in the following version: QuRouter 2.4.6.028 and later

CVSS 4.0 · 2.4 Low EPSS < 1% KEV · Not listed

Vendors

Qnap

Products

Qurouter

CVE-2024-13088

QHora

An improper authentication vulnerability has been reported to affect QHora. If an attacker gains local network access, they can then exploit the vulnerability to compromise the security of the system. We have already fixed the vulnerability in the following version: QuRouter 2.5.0.140 and later

CVSS 4.0 · 5.2 Medium EPSS < 1% KEV · Not listed

Vendors

Qnap

Products

Qurouter

CVE-2023-23356

QuFirewall

A command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote attackers who have gained administrator access to execute arbitrary commands. We have already fixed the vulnerability in the following versions: QuFirewall 2.3.3 ( 2023/03/27 ) and later and later

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Qnap

Products

Qufirewall

CVE-2024-50389

QuRouter

A SQL injection vulnerability has been reported to affect QuRouter. If exploited, the vulnerability could allow remote attackers to inject malicious code. We have already fixed the vulnerability in the following version: QuRouter 2.4.5.032 and later

CVSS 4.0 · 9.5 Critical EPSS < 1% KEV · Not listed

Vendors

Qnap

Products

Qurouter

CVE-2024-48861

QHora

An OS command injection vulnerability has been reported to affect several product versions. If exploited, the vulnerability could allow local network attackers to execute commands. We have already fixed the vulnerability in the following versions: QuRouter 2.4.4.106 and later

CVSS 4.0 · 7.3 High EPSS < 1% KEV · Not listed

Vendors

Qnap

Products

Qurouter

CVE-2024-48860

QHora

An OS command injection vulnerability has been reported to affect several product versions. If exploited, the vulnerability could allow remote attackers to execute commands. We have already fixed the vulnerability in the following version: QuRouter 2.4.3.103 and later

CVSS 4.0 · 9.5 Critical EPSS 1.5% KEV · Not listed

Vendors

Qnap

Products

Qurouter

CVE-2025-29887

QuRouter 2.5

A command injection vulnerability has been reported to affect QuRouter 2.5.1. If a remote attacker gains an administrator account, they can then exploit the vulnerability to execute arbitrary commands. We have already fixed the vulnerability in the following version: QuRouter 2.5.1.060 and later

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Qnap

Products

Qurouter

CVE-2024-56805

QTS, QuTS hero

A buffer overflow vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote attackers who have gained user access to modify memory or crash processes. We have already fixed the vulnerability in the following versions: QTS 5.2.4.3079 build 20250321 and later QuTS hero h5.2.4.3079 build 20250321 and later

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Qnap

Products

Qts Quts Hero

CVE-2024-53699

QTS, QuTS hero

An out-of-bounds write vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote attackers who have gained administrator access to modify or corrupt memory. We have already fixed the vulnerability in the following versions: QTS 5.2.3.3006 build 20250108 and later QuTS hero h5.2.3.3006 build 20250108 and later

CVSS 4.0 · 2.1 Low EPSS < 1% KEV · Not listed

Vendors

Qnap

Products

Qts Quts Hero

CVE-2024-53698

QTS, QuTS hero

A double free vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote attackers who have gained administrator access to modify memory. We have already fixed the vulnerability in the following versions: QTS 5.2.3.3006 build 20250108 and later QuTS hero h5.2.3.3006 build 20250108 and later

CVSS 4.0 · 2.1 Low EPSS < 1% KEV · Not listed

Vendors

Qnap

Products

Qts Quts Hero

CVE-2024-53697

QTS, QuTS hero

An out-of-bounds write vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote attackers who have gained administrator access to modify or corrupt memory. We have already fixed the vulnerability in the following versions: QTS 5.2.3.3006 build 20250108 and later QuTS hero h5.2.3.3006 build 20250108 and later

CVSS 4.0 · 2.1 Low EPSS < 1% KEV · Not listed

Vendors

Qnap

Products

Qts Quts Hero

CVE-2024-38638

QTS, QuTS hero

An out-of-bounds write vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote attackers who have gained administrator access to modify or corrupt memory. QTS 5.2.x/QuTS hero h5.2.x are not affected. We have already fixed the vulnerability in the following versions: QTS 5.1.9.2954 build 20241120 and later QuTS hero h5.1.9.2954 build 20241120 and later

CVSS 4.0 · 2.1 Low EPSS < 1% KEV · Not listed

Vendors

Qnap

Products

Qts Quts Hero

CVE-2024-50403

QTS, QuTS hero

A use of externally-controlled format string vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote attackers who have gained administrator access to obtain secret data or modify memory. We have already fixed the vulnerability in the following versions: QTS 5.2.2.2950 build 20241114 and later QuTS hero h5.2.2.2952 build 20241116 and later

CVSS 4.0 · 2.1 Low EPSS < 1% KEV · Not listed

Vendors

Qnap

Products

Qts Quts Hero

CVE-2024-50402

QTS, QuTS hero

A use of externally-controlled format string vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote attackers who have gained administrator access to obtain secret data or modify memory. We have already fixed the vulnerability in the following versions: QTS 5.1.9.2954 build 20241120 and later QTS 5.2.2.2950 build 20241114 and later QuTS hero h5.1.9.2954 build 20241120 and later QuTS hero h5.2.2.2952 build 20241116 and later

CVSS 4.0 · 2.1 Low EPSS < 1% KEV · Not listed

Vendors

Qnap

Products

Qts Quts Hero

CVE-2024-50393

QTS, QuTS hero

A command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote attackers to execute arbitrary commands. We have already fixed the vulnerability in the following versions: QTS 5.1.9.2954 build 20241120 and later QTS 5.2.2.2950 build 20241114 and later QuTS hero h5.1.9.2954 build 20241120 and later QuTS hero h5.2.2.2952 build 20241116 and later

CVSS 4.0 · 8.7 High EPSS 1.3% KEV · Not listed

Vendors

Qnap

Products

Qts Quts Hero

CVE-2024-48868

QTS, QuTS hero

An improper neutralization of CRLF sequences ('CRLF Injection') vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote attackers to modify application data. We have already fixed the vulnerability in the following versions: QTS 5.1.9.2954 build 20241120 and later QTS 5.2.2.2950 build 20241114 and later QuTS hero h5.1.9.2954 build 20241120 and later QuTS hero h5.2.2.2952 build 20241116 and later

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Qnap

Products

Qts Quts Hero