CVE-2024-53691

CVE-2024-53691 is a link-following (CWE-59) vulnerability in QNAP's QTS and QuTS hero NAS operating systems that lets an attacker traverse the file system to unintended locations. It is triggered remotely over the network by an attacker who has already obtained user-level access to the device; no user interaction is required, and the lack of UI/privilege requirements in the CVSS 4.0 vector (8.7 High) means a low-privileged account is the main barrier. Successful exploitation carries high impact on confidentiality, integrity, and availability of the vulnerable system, allowing the attacker to read, modify, or affect files outside the intended scope via manipulated links. Any QNAP NAS running QTS or QuTS hero in the affected 5.1.x/5.2.x branches prior to the fixed builds is affected, with internet-exposed devices and those granting accounts to third parties at greatest risk. There is no known public proof-of-concept and the flaw is not yet in CISA's KEV catalog, but a 20.1% EPSS score (97th percentile) indicates a meaningful chance of exploitation within 30 days.

What to do: Upgrade to QTS 5.1.8.2823 build 20240712 (or later), QTS 5.2.0.2802 build 20240620 (or later), QuTS hero h5.1.8.2823 build 20240712 (or later), or QuTS hero h5.2.0.2802 build 20240620 (or later). Until patched, restrict or firewall web/admin access to trusted networks, avoid exposing the NAS interface directly to the internet, and audit user accounts since exploitation requires user-level credentials. Monitor QNAP advisories for evidence of in-the-wild exploitation given the elevated EPSS score.