CVE-2023-41292 is a buffer copy vulnerability affecting QNAP QTS, QuTS hero, and QuTScloud operating systems. This flaw allows authenticated administrators to execute arbitrary code remotely via the network. With a CVSS score of 7.2 (High), it presents a significant risk, enabling full compromise of confidentiality, integrity, and availability. While no public exploits or active exploitation have been observed, and community discussion is minimal, QNAP has released patches in QTS 5.1.4.2596 build 20231128, QuTS hero h5.1.4.2596 build 20231128, and QuTScloud c5.1.5.2651 and later versions.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
5.1.0.2348CPE matchmatch criteria | cpe:2.3:o:qnap:qts:5.1.0.2348:build_20230325:*:*:*:*:*:* | ||
5.1.0.2399CPE matchmatch criteria | cpe:2.3:o:qnap:qts:5.1.0.2399:build_20230515:*:*:*:*:*:* | ||
5.1.0.2418CPE matchmatch criteria | cpe:2.3:o:qnap:qts:5.1.0.2418:build_20230603:*:*:*:*:*:* | ||
5.1.0.2444CPE matchmatch criteria | cpe:2.3:o:qnap:qts:5.1.0.2444:build_20230629:*:*:*:*:*:* | ||
5.1.0.2466CPE matchmatch criteria | cpe:2.3:o:qnap:qts:5.1.0.2466:build_20230721:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:L
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.3 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.