CVE-2023-39298 is a high severity (CVSS 7.8) missing authorization flaw in QNAP QTS and QuTS hero. A local authenticated user can access data or perform actions they should not be allowed to, through unspecified vectors. QNAP fixed it in QTS 5.2.0.2737 build 20240417 and QuTS hero h5.2.0.2782 build 20240601.
What's affected
The NVD record scores this 7.8 (High) with the vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. The affected products it lists are QNAP QTS and QuTS hero builds, including QTS 5.1.0.2348 (build 20230325), QTS 5.1.0.2399 (build 20230515), QTS 5.1.0.2418 (build 20230603) and more. The advisory wording covers several QNAP operating system versions, so treat any build older than the fixed list as exposed.
Fixed versions, as quoted in the record from the QNAP advisory: QTS 5.2.0.2737 build 20240417 and later, and QuTS hero h5.2.0.2782 build 20240601 and later. The record says QuTScloud is not affected. The record was published in September 2024, well after the fixed builds shipped.
The weakness class is CWE-862 (missing authorization). The record does not mark this CVE as being in the CISA Known Exploited Vulnerabilities catalog, and nothing we could read says it is exploited in the wild.
How to check if you're exposed
Look at the firmware version on each NAS you run.
In QTS or QuTS hero, open Control Panel, then System, then Firmware Update. The installed version and build number are shown there, and the same page can check for a newer build. Compare the build against the fixed list above.
Also check how each device is reachable. A NAS whose admin interface is open to the internet, or to a flat internal network, is a larger risk than one limited to a management segment.
What to do now
- Find QTS and QuTS hero devices and their builds.
- Update to QTS 5.2.0.2737 build 20240417 or later, or QuTS hero h5.2.0.2782 build 20240601 or later. The advisory is QSA-24-28.
- Review which local accounts exist on each NAS and remove any that are not in use.
- Do not hand out shell or local access on a NAS to people who only need file shares.
Why it matters
Missing authorization means the system checks who you are but not whether you may do the thing you are asking for. The record gives no more detail than that the access happens through unspecified vectors, so we cannot say which functions are affected. The advisory should be read for anything more precise.
The vector is local and needs a login, so the risk is mostly about insiders and about attackers who already hold a low privilege account. That still matters on shared storage. Patching, and keeping local access narrow, are the sensible controls.
Quick check
Why is the attack vector local?
The record says local authenticated users. An attacker needs an account and a session on the device, not just network reach.
Is QuTScloud affected?
The record says QuTScloud is not affected by this one.
Sources
- QNAP security advisory QSA-24-28 (listed in the record; the page returned no readable content when we fetched it, so fixed versions here come from the NVD record, which quotes the advisory text)
- Safeguard Gold entry for CVE-2023-39298
Last reviewed: 19 October 2026.
