CVE-2024-53697
Published: 07 March 2025
Description
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.
Security Summary
CVE-2024-53697 is an out-of-bounds write vulnerability (CWE-787) affecting several versions of QNAP operating systems, including QTS and QuTS hero. Published on 2025-03-07, the flaw carries a CVSS v3.1 base score of 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), indicating network accessibility with low attack complexity but requiring high privileges.
The vulnerability can be exploited by remote attackers who have already gained administrator access. Exploitation enables modification or corruption of memory, resulting in high impacts to confidentiality, integrity, and availability.
QNAP has fixed the vulnerability in QTS 5.2.3.3006 build 20250108 and later, as well as QuTS hero h5.2.3.3006 build 20250108 and later. Affected systems should be updated to these versions or higher for mitigation. Additional details are available in QNAP's security advisory at https://www.qnap.com/en/security-advisory/qsa-24-54.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise Techniques
Why these techniques?
Out-of-bounds write (memory corruption) requires administrator access to exploit and enables high-impact modification of memory, directly facilitating privilege escalation on the affected QNAP system.