CVE-2024-37049CWE-120CWE-121

QTS, QuTS hero

Medium · published November 22, 2024

CVSS v4.0
5.1
EPSS
1%
Percentile
57.3
In the wild
Unconfirmed
What it is

A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote attackers who have gained administrator access to execute code.

We have already fixed the vulnerability in the following versions:

QTS 5.2.1.2930 build 20241025 and later

QuTS hero h5.2.1.2929 build 20241025 and later

The record
Technical detail
CVSS v4.0
5.1 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N
EPSS
0.00837 · 57.3th percentile
Weaknesses
CWE-120 · Buffer Copy without Checking Size of Input ('Classic Buffer Overflow'); CWE-121 · Stack-based Buffer Overflow
Published
2024-11-22T15:32Z
EPSS history
Timeline
  • 22 NOV 15:32Z
    QTS, QuTS hero
    cvelistv5