Vulnerability in Legacy QTS

Summary

A buffer copy without checking size of input vulnerability has been reported to affect certain legacy versions of QTS. If exploited, the vulnerability could allow clients to execute code via unspecified vectors.

We have already fixed the vulnerability in the following versions:

• QTS 4.3.6.2441 build 20230621 and later
• QTS 4.3.4.2451 build 20230621 and later
• QTS 4.3.3.2420 build 20230621 and later
• QTS 4.2.6 build 20230621 and later

QTS versions 4.4.x, 4.5.x, and 5.x are not affected. QuTS hero is also not affected.

Recommendation

To secure your device, we recommend regularly updating your system to the latest version to benefit from vulnerability fixes. You can check the product support status to see the latest updates available to your NAS model.

Updating QTS

1. Log in to QTS as an administrator.
2. Go to Control Panel > System > Firmware Update.
3. Under Live Update, click Check for Update.
   The system downloads and installs the latest available update.

Tip: You can also download the update from the QNAP website. Go to Support > Download Center and then perform a manual update for your specific device.