CVE-2024-21902

EUVD-2024-19513
An incorrect permission assignment for critical resource vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated users to read or modify the resource via a network.

We have already fixed the vulnerability in the following version:
QTS 5.1.7.2770 build 20240520 and later
QuTS hero h5.1.7.2770 build 20240520 and later
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
6.4 MEDIUM
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 65%
Affected Products (NVD)
VendorProductVersion
qnapqts
5.1.0.2348:build_20230325
qnapqts
5.1.0.2399:build_20230515
qnapqts
5.1.0.2418:build_20230603
qnapqts
5.1.0.2444:build_20230629
qnapqts
5.1.0.2466:build_20230721
qnapqts
5.1.1.2491:build_20230815
qnapqts
5.1.2.2533:build_20230926
qnapqts
5.1.3.2578:build_20231110
qnapqts
5.1.4.2596:build_20231128
qnapqts
5.1.5.2645:build_20240116
qnapqts
5.1.5.2679:build_20240219
qnapqts
5.1.6.2722:build_20240402
𝑥
= Vulnerable software versions
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
VendorProductVersionSource
qnapqts
5.1.x ≤
𝑥
< 5.1.7.2770 build 20240520
ADP
qnapquts_hero
h5.1.x ≤
𝑥
< h5.1.7.2770 build 20240520
ADP
Common Weakness Enumeration
References
https://www.qnap.com/en/security-advisory/qsa-24-23
https://www.qnap.com/en/security-advisory/qsa-24-23