CVE-2024-38639

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2024-38639", "assignerOrgId": "2fd009eb-170a-4625-932b-17a53af1051f", "state": "PUBLISHED", "assignerShortName": "qnap", "dateReserved": "2024-06-19T00:17:01.279Z", "datePublished": "2026-09-18T06:51:06.187Z", "dateUpdated": "2026-09-18T14:31:44.689Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "2fd009eb-170a-4625-932b-17a53af1051f", "shortName": "qnap", "dateUpdated": "2026-09-18T06:51:06.187Z"}, "title": "QTS", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-287", "description": "CWE-287", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-115", "descriptions": [{"lang": "en", "value": "CAPEC-115"}]}], "affected": [{"vendor": "QNAP Systems Inc.", "product": "QTS", "versions": [{"status": "unaffected", "version": "?"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "An improper authentication vulnerability has been reported to affect product. The remote attackers can then exploit the vulnerability to compromise the security of the system.\nQTS is not affected.\n\nWe have already fixed the vulnerability in the following version:", "supportingMedia": [{"type": "text/html", "base64": false, "value": "An improper authentication vulnerability has been reported to affect product. The remote attackers can then exploit the vulnerability to compromise the security of the system.<br>QTS is not affected.<br><br>We have already fixed the vulnerability in the following version:<br>"}]}], "references": [{"url": "https://www.qnap.com/en/security-advisory/qsa-24-37"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "HIGH", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "availabilityImpact": "LOW", "baseSeverity": "MEDIUM", "baseScore": 4.8, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L"}}], "solutions": [{"lang": "en", "value": "We have already fixed the vulnerability in the following version:", "supportingMedia": [{"type": "text/html", "base64": false, "value": "We have already fixed the vulnerability in the following version:<br>"}]}], "credits": [{"lang": "en", "value": "Lu\u00eds Almeida Teles", "type": "finder"}], "source": {"advisory": "QSA-24-37", "discovery": "EXTERNAL"}, "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-38639", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-09-18T14:15:06.086803Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-18T14:31:44.689Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-38639", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-09-18T14:15:06.086803Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-18T14:30:07.312Z"}}], "cna": {"title": "QTS", "source": {"advisory": "QSA-24-37", "discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Lu\u00eds Almeida Teles"}], "impacts": [{"capecId": "CAPEC-115", "descriptions": [{"lang": "en", "value": "CAPEC-115"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.8, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "QNAP Systems Inc.", "product": "QTS", "versions": [{"status": "unaffected", "version": "?"}], "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "We have already fixed the vulnerability in the following version:", "supportingMedia": [{"type": "text/html", "value": "We have already fixed the vulnerability in the following version:<br>", "base64": false}]}], "references": [{"url": "https://www.qnap.com/en/security-advisory/qsa-24-37"}], "x_generator": {"engine": "Vulnogram 0.1.0-dev"}, "descriptions": [{"lang": "en", "value": "An improper authentication vulnerability has been reported to affect product. The remote attackers can then exploit the vulnerability to compromise the security of the system.\nQTS is not affected.\n\nWe have already fixed the vulnerability in the following version:", "supportingMedia": [{"type": "text/html", "value": "An improper authentication vulnerability has been reported to affect product. The remote attackers can then exploit the vulnerability to compromise the security of the system.<br>QTS is not affected.<br><br>We have already fixed the vulnerability in the following version:<br>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-287", "description": "CWE-287"}]}], "providerMetadata": {"orgId": "2fd009eb-170a-4625-932b-17a53af1051f", "shortName": "qnap", "dateUpdated": "2026-09-18T06:51:06.187Z"}}}, "cveMetadata": {"cveId": "CVE-2024-38639", "state": "PUBLISHED", "dateUpdated": "2026-09-18T14:31:44.689Z", "dateReserved": "2024-06-19T00:17:01.279Z", "assignerOrgId": "2fd009eb-170a-4625-932b-17a53af1051f", "datePublished": "2026-09-18T06:51:06.187Z", "assignerShortName": "qnap"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "QTS", "vendor": "QNAP Systems Inc.", "versions": [{"status": "unaffected", "version": "?"}]}], "source": "security@qnapsecurity.com.tw"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "An improper authentication vulnerability has been reported to affect product. The remote attackers can then exploit the vulnerability to compromise the security of the system.\nQTS is not affected.\n\nWe have already fixed the vulnerability in the following version:"}, {"lang": "es", "value": "Se ha reportado una vulnerabilidad de autenticaci\u00f3n impropia que afecta al producto. Los atacantes remotos pueden entonces explotar la vulnerabilidad para comprometer la seguridad del sistema.\nQTS no est\u00e1 afectado.\n\nYa hemos corregido la vulnerabilidad en la siguiente versi\u00f3n:"}], "id": "CVE-2024-38639", "lastModified": "2026-09-28T14:10:00.213", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 4.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 2.5, "source": "security@qnapsecurity.com.tw", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-38639", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-09-18T14:15:06.086803Z", "version": "2.0.3"}}]}, "published": "2026-09-18T07:16:49.293", "references": [{"source": "security@qnapsecurity.com.tw", "url": "https://www.qnap.com/en/security-advisory/qsa-24-37"}], "sourceIdentifier": "security@qnapsecurity.com.tw", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-287"}], "source": "security@qnapsecurity.com.tw", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,*]"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "QTS", "source": "cna", "vendor": "QNAP Systems Inc."}, "product": "qts", "vendor": "qnap"}], "created": "2026-09-18T23:30:15.499952+00:00", "title": "Improper Authentication Vulnerability in QNAP Systems Exposes Remote Access", "updated": "2026-09-19T21:30:16.423396+00:00", "vendors": ["qnap", "qnap$PRODUCT$qts"]}