This report was translated by AI; nobody has reviewed the translation yet. Original language: Slovak.
[TLP:CLEAR] QNAP fixes 28 vulnerabilities in various products
QNAP fixes 28 vulnerabilities in QNAP Photo, QuRouter, Notes Station 3, QuLog Center, AI Core, QTS and QuTS Hero [1][2][3][4][5][6][7][8][9][10][11][12]. Individual products and their fixed versions: QNAP Photo - 6.4.3 [1][2][3][4] QNAP QuRouter - 2.4.3.103 [5][6] QNAP Notes Station - 3.9.7 [7][8] QNAP QuLog Center - 1.7.0.831, 1.8.0.888 [9] QNAP AI Core - 3.4.1 [10] QNAP QTS - 5.2.1.2930 build 20241025 [11] QNAP QuTS Hero - h5.2.1.2929 build 20241025 [12]
Allows an authenticated remote attacker to perform an XSS attack in QNAP Photo Station [13][1][2][3][4].
The vulnerability is present in product:
- QNAP Photo Station; >=6.4, <6.4.3;
CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N
More information:
- CVE-2024-32767 at cve.org, NVD
- CVE-2024-32768 at cve.org, NVD
- CVE-2024-32769 at cve.org, NVD
- CVE-2024-32770 at cve.org, NVD
- CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') at cwe.mitre.org
The vulnerability was publicly disclosed 22. 11. 2024.
Allows an unauthenticated remote attacker to execute commands without authorization in QNAP QuRouter [14][5][6].
The vulnerability is present in product:
- QNAP QuRouter; >=2.4, <2.4.3.106;
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
More information:
- CVE-2024-48860 at cve.org, NVD
- CVE-2024-48861 at cve.org, NVD
- CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') at cwe.mitre.org
The vulnerability was publicly disclosed 22. 11. 2024.
Allows an unauthenticated remote attacker to gain unauthorized access to critical functionality in QNAP Notes Station 3, through which they can gain access to the system of the affected machine [15][7].
The vulnerability is present in product:
- QNAP Notes Station 3; >=3.9, <3.9.7;
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
More information:
- CVE-2024-38643 at cve.org, NVD
- CWE-306: Missing Authentication for Critical Function at cwe.mitre.org
The vulnerability was publicly disclosed 23. 11. 2024.
Allows an authenticated remote attacker to execute arbitrary operating system commands on the affected machine in QNAP Notes Station 3 [15][8].
The vulnerability is present in product:
- QNAP Notes Station 3; >=3.9, <3.9.7;
CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
More information:
- CVE-2024-38644 at cve.org, NVD
- CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') at cwe.mitre.org
The vulnerability was publicly disclosed 22. 11. 2024.
Allows an unauthenticated remote attacker to gain unauthorized access to arbitrary locations in the file system in QNAP QuLog Center [16][9].
The vulnerability is present in product:
- QNAP QuLog Center; >=1.7, <1.7.0.831; >=1.8, <1.8.0.888;
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
More information:
- CVE-2024-48862 at cve.org, NVD
- CWE-59: Improper Link Resolution Before File Access ('Link Following') at cwe.mitre.org
The vulnerability was publicly disclosed 22. 11. 2024.
Allows an unauthenticated remote attacker to bypass system security in QNAP AI Core [17][10].
The vulnerability is present in product:
- QNAP AI Core; >=3.4, <3.4.1;
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L
More information:
- CVE-2024-38647 at cve.org, NVD
- CWE-540: Inclusion of Sensitive Information in Source Code at cwe.mitre.org
The vulnerability was publicly disclosed 22. 11. 2024.
Allows an authenticated remote attacker to access potentially sensitive data and overwrite data in memory in QNAP QTS and Quts Hero [18][12].
CVSS: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
More information:
- CVE-2024-50397 at cve.org, NVD
- CWE-134: Use of Externally-Controlled Format String at cwe.mitre.org
The vulnerability was publicly disclosed 23. 11. 2024.
Allows an unauthenticated remote attacker to access potentially sensitive data and overwrite data in memory in QNAP QTS and Quts Hero [18][11].
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
More information:
- CVE-2024-50396 at cve.org, NVD
- CWE-134: Use of Externally-Controlled Format String at cwe.mitre.org
The vulnerability was publicly disclosed 23. 11. 2024.
Links
- [1] https://www.cve.org/CVERecord?id=CVE-2024-32767
- [2] https://www.cve.org/CVERecord?id=CVE-2024-32768
- [3] https://www.cve.org/CVERecord?id=CVE-2024-32769
- [4] https://www.cve.org/CVERecord?id=CVE-2024-32770
- [5] https://www.cve.org/CVERecord?id=CVE-2024-48860
- [6] https://www.cve.org/CVERecord?id=CVE-2024-48861
- [7] https://www.cve.org/CVERecord?id=CVE-2024-38643
- [8] https://www.cve.org/CVERecord?id=CVE-2024-38644
- [9] https://www.cve.org/CVERecord?id=CVE-2024-48862
- [10] https://www.cve.org/CVERecord?id=CVE-2024-38647
- [11] https://www.cve.org/CVERecord?id=CVE-2024-50396
- [12] https://www.cve.org/CVERecord?id=CVE-2024-50397
- [13] https://www.qnap.com/en/security-advisory/qsa-24-39
- [14] https://www.qnap.com/en/security-advisory/qsa-24-44
- [15] https://www.qnap.com/en/security-advisory/qsa-24-36
- [16] https://www.qnap.com/en/security-advisory/qsa-24-46
- [17] https://www.qnap.com/en/security-advisory/qsa-24-40
- [18] https://www.qnap.com/en/security-advisory/qsa-24-43
By CESNET, z.s.p.o. Martin Krajči on 6. 12. 2024.