CVE-2023-34972
LowCVSS 3.5Exploitation Probability (EPSS)
Low risk5th percentile - higher than 5% of all known CVEs
Summary
A vulnerability has been reported affecting QNAP operating systems regarding the cleartext transmission of sensitive information. If exploited, local network clients may read unexpected sensitive data via unspecified vectors.
Risk Assessment
This vulnerability may lead to the exposure of sensitive information within the local network, posing a risk to the organization's data security.
Recommendation
It is recommended to update QNAP operating systems to QTS 5.0.1.2425 (build 20230609) or later, QTS 5.1.0.2444 (build 20230629) or later, and QuTS hero h5.1.0.2424 (build 20230609) or later.
Other vulnerabilities in Systemy operacyjne QNAP
See all- CVE-2023-34973Low
An insufficient entropy vulnerability has been reported to affect QNAP operating systems. If exploited, the vulnerability possibly allows remote users to predict secret via unspecified vectors.
- CVE-2023-34971High
A vulnerability related to inadequate encryption strength has been reported to affect QNAP operating systems. If exploited, local network clients may decrypt data using brute force attacks via unspecified vectors.
Original NVD description (English source)
A cleartext transmission of sensitive information vulnerability has been reported to affect QNAP operating systems. If exploited, the vulnerability possibly allows local network clients to read the contents of unexpected sensitive data via unspecified vectors. We have already fixed the vulnerability in the following versions: QTS 5.0.1.2425 build 20230609 and later QTS 5.1.0.2444 build 20230629 and later QuTS hero h5.1.0.2424 build 20230609 and later
Vulnerability data from NVD (NIST) · CISA KEV · EPSS