Skip to main content

Proof-of-Concept Exploit Released for CVE-2024-53691 in QNAP QTS and QuTS NAS

Security researchers claim CVE-2024-53691 could lead to RCE

Report a cyber attack: call 0300 303 5222 or email [email protected]

Summary

Security researchers claim CVE-2024-53691 could lead to RCE


Affected platforms

The following platforms are known to be affected:

Threat details

Affected version has reached End-of-Life (EOL)

QNAP has stated QTS and QUTS hero version 5.1.x are considered End-of-life (EOL) and are no longer supported. Please refer to QNAP's Operating System Lifecycle Overview for EOL dates. 


Introduction

QNAP has released a security advisory addressing three vulnerabilities in the QTS and QuTS products. QTS and QuTS are the operating system for QNAP Network-attached storage (NAS) appliances.

  • CVE-2023-39298 is a 'Missing authorisation' vulnerability with a CVSSv3 score of 7.8. If exploited, a local attacker with low privileges could access data or perform actions without proper privileges
  • CVE-2024-53691 is a 'Link following' vulnerability with a CVSSv4 score of 8.7. If exploited, a remote attacker with low privileges could perform path traversal.

The advisory also addresses one further low severity vulnerability. 

Proof-of-concept exploit for CVE-2024-53691

Security researchers have released a public proof-of-concept (PoC) exploit for vulnerability CVE-2024-53691, that QNAP states could lead to path traversal. Security researchers claim that the PoC exploit could be used to overwrite critical files and execute remote code (RCE). NHS England National CSOC assesses exploitation as more likely. 


Remediation advice

Affected organisations are encouraged to review QNAP's Security Advisory QSA-24-28 and apply any updates as soon as practicable.


Definitive source of threat updates


CVE Vulnerabilities

Last edited: 17 January 2025 4:05 pm