Qnap: Three Resolved Vulnerabilities in QTS and QuTS hero NAS OS

Qnap Systems, Inc. had published 3 security advisories concerning resolved vulnerabilities QTS and QuTS hero NAS OS.

Resolved Vulnerability in QTS and QuTS hero QSA-23-60

Release date: August 25, 2023
Security ID: QSA-23-60
Severity: High
CVE identifier: CVE-2023-34971
Affected products: QTS 5.1.0, 5.0.1, 4.5.4; QuTS hero h5.1.0, h4.5.4
Status: Resolved

Summary
An inadequate encryption strength vulnerability has been reported to affect certain Qnap OSs. If exploited, the vulnerability could allow local network clients to decrypt data using brute force attacks via unspecified vectors.

The company have already fixed the vulnerability in the following OSs versions:

QTS 5.1.0.2444 build 20230629 and later
QTS 5.0.1.2425 build 20230609 and later
QTS 4.5.4.2467 build 20230718 and later
QuTS hero h5.1.0.2424 build 20230609 and later
QuTS hero h4.5.4.2476 build 20230728 and later

Recommendation
To secure user’ device, the company recommend regularly updating system to the latest version to benefit from vulnerability fixes. User can check the product support status to see the latest updates available to NAS model.

Updating QTS or QuTS hero

Log in to QTS or QuTS hero as an administrator.
Go to Control Panel > System > Firmware Update.
Under Live Update, click Check for Update.
The system downloads and installs the latest available update.

Tip: User can also download the update from the Qnap website. Go to Support > Download Center and then perform a manual update for your specific device.

Attachment

CVE-2023-34971.json

Acknowledgements: Domen Puncer Kugler

Revision History:
V1.0 (August 25, 2023) – Published

Resolved Vulnerability in QTS and QuTS hero QSA-23-59

Release date: August 25, 2023
Security ID: QSA-23-59
Severity: Low
CVE identifier: CVE-2023-34973
Affected products: QTS 5.1.0, 5.0.1; QuTS hero h5.1.0
Status: Resolved

Summary
An insufficient entropy vulnerability has been reported to affect certain versions of Qnap OSs. If exploited, the vulnerability could allow remote users to predict secrets via unspecified vectors.

The company have already fixed the vulnerability in the following OSs versions:

QTS 5.1.0.2444 build 20230629 and later
QTS 5.0.1.2425 build 20230609 and later
QuTS hero h5.1.0.2424 build 20230609 and later

Updating QTS or QuTS hero

Log in to QTS or QuTS hero as an administrator.
Go to Control Panel > System > Firmware Update.
Under Live Update, click Check for Update.
The system downloads and installs the latest available update.

Tip: User can also download the update from the Qnap website. Go to Support > Download Center and then perform a manual update for specific device.

Attachment

CVE-2023-34973.json

Acknowledgements: Domen Puncer Kugler

Revision History:
V1.0 (August 25, 2023) – Published

Resolved Vulnerability in QTS and QuTS hero QSA-23-58

Release date: August 25, 2023
Security ID: QSA-23-58
Severity: Low
CVE identifier: CVE-2023-34972
Affected products: QTS 5.1.0, 5.0.1; QuTS hero h5.1.0
Status: Resolved

Summary
A cleartext transmission of sensitive information vulnerability has been reported to affect certain Qnap OSs. If exploited, the vulnerability could allow local network clients to read sensitive data via unspecified vectors.

The firm have already fixed the vulnerability in the following OS versions:

QTS 5.1.0.2444 build 20230629 and later
QTS 5.0.1.2425 build 20230609 and later
QuTS hero h5.1.0.2424 build 20230609 and later

Updating QTS or QuTS hero

Log in to QTS, QuTS hero, or QES as an administrator.
Go to Control Panel > System > Firmware Update.
Under Live Update, click Check for Update.
The system downloads and installs the latest available update.

Tip: User can also download the update from the Qnap website. Go to Support > Download Center and then perform a manual update for specific device.

Attachment

CVE-2023-34972.json

Acknowledgements: Domen Puncer Kugler

Revision History:
V1.0 (August 25, 2023) – Published