CVE-2024-50400

Published: Nov 22, 2024Modified: Jun 17, 2026

2.1

Vector

CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XShow less

Source: security@qnapsecurity.com.tw (Secondary)

Description

A use of externally-controlled format string vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote attackers who have gained administrator access to obtain secret data or modify memory. We have already fixed the vulnerability in the following versions: QTS 5.2.1.2930 build 20241025 and later QuTS hero h5.2.1.2929 build 20241025 and later

Affected (14)

Products: Qnap: Qts, Quts Hero

Qnap

2 products

Qts

Quts Hero

Configuration A

7 vulnerable

Vulnerable Software	Affected Versions
Qnap Qts	Version 5.2.0.2737 build_20240417
Qnap Qts	Version 5.2.0.2744 build_20240424
Qnap Qts	Version 5.2.0.2782 build_20240601
Qnap Qts	Version 5.2.0.2802 build_20240620
Qnap Qts	Version 5.2.0.2823 build_20240711
Qnap Qts	Version 5.2.0.2851 build_20240808
Qnap Qts	Version 5.2.0.2860 build_20240817

Configuration B

7 vulnerable

Vulnerable Software	Affected Versions
Qnap Quts Hero	Version h5.2.0.2737 build_20240417
Qnap Quts Hero	Version h5.2.0.2782 build_20240601
Qnap Quts Hero	Version h5.2.0.2789 build_20240607
Qnap Quts Hero	Version h5.2.0.2802 build_20240620
Qnap Quts Hero	Version h5.2.0.2823 build_20240711
Qnap Quts Hero	Version h5.2.0.2851 build_20240808
Qnap Quts Hero	Version h5.2.0.2860 build_20240817

Related CWEs

CWE-134

Use of Externally-Controlled Format String

The product uses a function that accepts a format string as an argument, but the format string originates from an external source.

References (1)

https://www.qnap.com/en/security-advisory/qsa-24-43

Source: security@qnapsecurity.com.tw

Vendor Advisory

Timeline

No history available yet.