CVE-2024-50396: qnap qts +1 lainnya

csirt@kutim:~/threat-intel/cve/CVE-2024-50396

CVSS 8.8 · High EPSS 0,63%

Kerentanan Use of Externally-Controlled Format String pada qnap qts, qnap quts hero. Skor CVSS 3.1 8.8 (High) menurut NVD.

Deskripsi (NVD)

A use of externally-controlled format string vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote attackers to obtain secret data or modify memory. We have already fixed the vulnerability in the following versions: QTS 5.2.1.2930 build 20241025 and later QuTS hero h5.2.1.2929 build 20241025 and later

Rincian

Terbit di NVD: 22 November 2024
Terakhir diubah: 17 Juni 2026
Status NVD: Analyzed
CVSS 3.1: 8.8 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-134: Use of Externally-Controlled Format String
EPSS (30 hari): 0,63% peluang dieksploitasi; lebih tinggi dari 49,0% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
qnap	qts	Versi 5.2.0.2737 build_20240417
qnap	qts	Versi 5.2.0.2744 build_20240424
qnap	qts	Versi 5.2.0.2782 build_20240601
qnap	qts	Versi 5.2.0.2802 build_20240620
qnap	qts	Versi 5.2.0.2823 build_20240711
qnap	qts	Versi 5.2.0.2851 build_20240808
qnap	qts	Versi 5.2.0.2860 build_20240817
qnap	quts hero	Versi h5.2.0.2737 build_20240417
qnap	quts hero	Versi h5.2.0.2782 build_20240601
qnap	quts hero	Versi h5.2.0.2789 build_20240607
qnap	quts hero	Versi h5.2.0.2802 build_20240620
qnap	quts hero	Versi h5.2.0.2823 build_20240711
qnap	quts hero	Versi h5.2.0.2851 build_20240808
qnap	quts hero	Versi h5.2.0.2860 build_20240817

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://www.qnap.com/en/security-advisory/qsa-24-43 advisory vendor

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:11 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.