CVE-2024-53691

Deeper analysis

A link following vulnerability, tracked as CVE-2024-53691 and assigned CWE-59, affects multiple versions of QNAP's QTS and QuTS hero operating systems. The flaw permits unauthorized traversal of the file system to unintended locations when triggered by an attacker.

Remote attackers who have already obtained user-level access can exploit the issue to reach restricted paths on the affected device, potentially exposing or manipulating sensitive files. The vulnerability carries a CVSS 4.0 score of 8.7, reflecting high impact on confidentiality, integrity, and availability with network access and low attack complexity.

QNAP's security advisory QSA-24-28 states that the issue has been resolved in QTS 5.1.8.2823 build 20240712 and later, QTS 5.2.0.2802 build 20240620 and later, QuTS hero h5.1.8.2823 build 20240712 and later, and QuTS hero h5.2.0.2802 build 20240620 and later; administrators should apply these updates to eliminate the exposure.

The associated EPSS score currently stands at 0.4805 with a recorded peak of 0.4953, indicating moderate and relatively stable exploitation probability since disclosure.