6.5

CVE-2024-37050

A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote attackers who have gained administrator access to execute code.

We have already fixed the vulnerability in the following versions:
QTS 5.2.1.2930 build 20241025 and later
QuTS hero h5.2.1.2929 build 20241025 and later

Verknüpft mit AI von unstrukturierten Daten zu bestehenden CPE der NVD
This information is available to logged-in users.
Data is provided by the National Vulnerability Database (NVD)
Qnap ≫ Qts Version5.2.0.2737 Updatebuild_20240417
Qnap ≫ Qts Version5.2.0.2744 Updatebuild_20240424
Qnap ≫ Qts Version5.2.0.2782 Updatebuild_20240601
Qnap ≫ Qts Version5.2.0.2802 Updatebuild_20240620
Qnap ≫ Qts Version5.2.0.2823 Updatebuild_20240711
Qnap ≫ Qts Version5.2.0.2851 Updatebuild_20240808
Qnap ≫ Qts Version5.2.0.2860 Updatebuild_20240817
Qnap ≫ Quts Hero Versionh5.2.0.2737 Updatebuild_20240417
Qnap ≫ Quts Hero Versionh5.2.0.2782 Updatebuild_20240601
Qnap ≫ Quts Hero Versionh5.2.0.2789 Updatebuild_20240607
Qnap ≫ Quts Hero Versionh5.2.0.2802 Updatebuild_20240620
Qnap ≫ Quts Hero Versionh5.2.0.2823 Updatebuild_20240711
Qnap ≫ Quts Hero Versionh5.2.0.2851 Updatebuild_20240808
Qnap ≫ Quts Hero Versionh5.2.0.2860 Updatebuild_20240817
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Type Source Score Percentile
EPSS FIRST.org 0.71% 0.714
CVSS Metriken
Source Base Score Exploit Score Impact Score Vector string
nvd@nist.gov 6.5 1.2 5.2
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H
security@qnapsecurity.com.tw 5.1 0 0
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CWE-120 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow.

CWE-121 Stack-based Buffer Overflow

A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function).