Proof-of-Concept Exploit Released for CVE-2024-53691 in QNAP QTS and QuTS NAS
Security researchers claim CVE-2024-53691 could lead to RCE
Summary
Security researchers claim CVE-2024-53691 could lead to RCE
Affected platforms
The following platforms are known to be affected:
Threat details
Affected version has reached End-of-Life (EOL)
QNAP has stated QTS and QUTS hero version 5.1.x are considered End-of-life (EOL) and are no longer supported. Please refer to QNAP's Operating System Lifecycle Overview for EOL dates.
Introduction
QNAP has released a security advisory addressing three vulnerabilities in the QTS and QuTS products. QTS and QuTS are the operating system for QNAP Network-attached storage (NAS) appliances.
- CVE-2023-39298 is a 'Missing authorisation' vulnerability with a CVSSv3 score of 7.8. If exploited, a local attacker with low privileges could access data or perform actions without proper privileges
- CVE-2024-53691 is a 'Link following' vulnerability with a CVSSv4 score of 8.7. If exploited, a remote attacker with low privileges could perform path traversal.
The advisory also addresses one further low severity vulnerability.
Proof-of-concept exploit for CVE-2024-53691
Security researchers have released a public proof-of-concept (PoC) exploit for vulnerability CVE-2024-53691, that QNAP states could lead to path traversal. Security researchers claim that the PoC exploit could be used to overwrite critical files and execute remote code (RCE). NHS England National CSOC assesses exploitation as more likely.
Remediation advice
Affected organisations are encouraged to review QNAP's Security Advisory QSA-24-28 and apply any updates as soon as practicable.
Definitive source of threat updates
CVE Vulnerabilities
Last edited: 17 January 2025 4:05 pm