QNAP QTS and QuTS hero Buffer Overflow Vulnerability Allowing Memory Modification or Process Crashes

A buffer overflow vulnerability has been identified in QNAP QTS and QuTS hero operating systems. This vulnerability affects several versions within the QTS 5.2.x series, as well as QuTS hero h5.2.x and h5.3.x. If a remote attacker gains access to an administrator account, they can exploit this vulnerability to modify memory or crash processes.

Impact

Exploitation of this vulnerability could lead to unauthorized memory modification or process crashes on the affected system.

Remediation

Users can update to QTS 5.2.8.3332 build 20251128 or later. For QuTS hero, update to h5.2.8.3321 build 20251117 or h5.3.1.3250 build 20250912 or later. Instructions for updating QTS or QuTS hero are available on the QNAP website.