Chumen77C411E

**Name of the Vulnerable Software and Affected Versions** QTS versions prior to 5.1.8.2823 build 20240712 QTS versions prior to 5.2.0.2802 build 20240620 QuTS hero versions prior to h5.1.8.2823 build 20240712 QuTS hero versions prior to h5.2.0.2802 build 20240620 **Description** The issue is related to a link following vulnerability that could allow remote attackers with user access to traverse the file system to unintended locations. This vulnerability may allow attackers to access sensitive files and execute arbitrary code, potentially leading to privilege escalation. **Recommendations** For QTS versions prior to 5.1.8.2823 build 20240712, update to QTS 5.1.8.2823 build 20240712 or later. For QTS versions prior to 5.2.0.2802 build 20240620, update to QTS 5.2.0.2802 build 20240620 or later. For QuTS hero versions prior to h5.1.8.2823 build 20240712, update to QuTS hero h5.1.8.2823 build 20240712 or later. For QuTS hero versions prior to h5.2.0.2802 build 20240620, update to QuTS hero h5.2.0.2802 build 20240620 or later.

**Name of the Vulnerable Software and Affected Versions** QNAP QTS versions prior to 5.2.0.2737 build 20240417 QNAP QuTS hero versions prior to h5.2.0.2782 build 20240601 **Description** A missing authorization issue has been reported, affecting several QNAP operating system versions. If exploited, it could allow local authenticated users to access data or perform actions they should not be allowed to via unspecified vectors. QuTScloud is not affected. **Recommendations** For QNAP QTS versions prior to 5.2.0.2737 build 20240417, update to QTS 5.2.0.2737 build 20240417 or later. For QNAP QuTS hero versions prior to h5.2.0.2782 build 20240601, update to QuTS hero h5.2.0.2782 build 20240601 or later.

**Name of the Vulnerable Software and Affected Versions** QNAP QTS versions prior to 5.2.0.2782 build 20240601 QNAP QuTS hero versions prior to h5.2.0.2782 build 20240601 **Description** An improper restriction of excessive authentication attempts issue has been reported to affect several QNAP operating system versions. If exploited, the issue could allow local network authenticated administrators to perform an arbitrary number of authentication attempts via unspecified vectors. QuTScloud is not affected. **Recommendations** For QNAP QTS versions prior to 5.2.0.2782 build 20240601, update to QTS 5.2.0.2782 build 20240601 or later. For QNAP QuTS hero versions prior to h5.2.0.2782 build 20240601, update to QuTS hero h5.2.0.2782 build 20240601 or later.