CVE-2023-39296 is a high severity (CVSS 7.5) prototype pollution flaw in QNAP QTS and QuTS hero. Over the network, a user can override existing attributes with incompatible types, which may crash the system. QNAP fixed it in QTS 5.1.3.2578 build 20231110 and later, and QuTS hero h5.1.3.2578 build 20231110 and later.
What's affected
The NVD record scores this 7.5 (High) with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. The affected products it lists are QNAP QTS and QuTS hero builds, including QTS 5.1.0.2348 (build 20230325), QTS 5.1.0.2399 (build 20230515), QTS 5.1.0.2418 (build 20230603) and more. The advisory wording covers several QNAP operating system versions, so treat any build older than the fixed list as exposed.
Fixed versions, as quoted in the record from the QNAP advisory: QTS 5.1.3.2578 build 20231110 and later, and QuTS hero h5.1.3.2578 build 20231110 and later. The vector lists no privileges and no user interaction, and the impact is on availability only. Nothing in the record suggests data theft or code execution.
The weakness class is CWE-1321 (improperly controlled modification of object prototype attributes). The record does not mark this CVE as being in the CISA Known Exploited Vulnerabilities catalog, and nothing we could read says it is exploited in the wild.
How to check if you're exposed
Look at the firmware version on each NAS you run.
In QTS or QuTS hero, open Control Panel, then System, then Firmware Update. The installed version and build number are shown there, and the same page can check for a newer build. Compare the build against the fixed list above.
Also check how each device is reachable. A NAS whose admin interface is open to the internet, or to a flat internal network, is a larger risk than one limited to a management segment.
What to do now
- List your QNAP devices and their build numbers.
- Update QTS to 5.1.3.2578 build 20231110 or later, and QuTS hero to h5.1.3.2578 build 20231110 or later. The advisory is QSA-23-64.
- Limit network access to the NAS web service to the networks that need it.
- Watch for unexplained crashes or restarts on devices that have not been updated, and note them in your incident log.
Why it matters
Prototype pollution is a bug class from JavaScript style runtimes. Objects there inherit attributes from a prototype, and code that merges untrusted input into an object can let that input change attributes it should never touch. The record describes the result as overriding existing attributes with ones of an incompatible type, which may lead to a crash.
The score is driven by availability. A crash on a NAS can stall file shares, backup jobs and anything mounted from it. The attack needs no login according to the vector, so exposure depends on who can reach the service. Patch, and keep the service off networks that do not need it.
Quick check
Can this lead to code execution?
The record only describes a crash. Prototype pollution can sometimes do more in other products, but this entry makes no such claim, so do not assume it.
Is this the same as the other QNAP CVEs in this range?
No. CVE-2023-39294, CVE-2023-39302 and CVE-2023-39297 are command injection issues, and each has its own advisory.
Sources
- QNAP security advisory QSA-23-64 (listed in the record; the page returned no readable content when we fetched it, so fixed versions here come from the NVD record, which quotes the advisory text)
- Safeguard Gold entry for CVE-2023-39296
Last reviewed: 19 October 2026.
