CVE-2023-39303 is a medium severity (CVSS 5.3) improper authentication flaw in QNAP QTS and QuTS hero. Over the network, users could compromise the security of the system. QNAP fixed it in QTS 5.1.3.2578 build 20231110 and later, QuTS hero h5.1.3.2578, and QuTScloud c5.1.5.2651.
What's affected
The NVD record scores this 5.3 (Medium) with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. The affected products it lists are QNAP QTS and QuTS hero builds, including QTS 5.1.0.2348 (build 20230325), QTS 5.1.0.2399 (build 20230515), QTS 5.1.0.2418 (build 20230603). The advisory wording covers several QNAP operating system versions, so treat any build older than the fixed list as exposed.
Fixed versions, as quoted in the record from the QNAP advisory: QTS 5.1.3.2578 build 20231110 and later, QuTS hero h5.1.3.2578 build 20231110 and later, and QuTScloud c5.1.5.2651 and later. The vector rates the impact as low confidentiality only, with no integrity or availability effect, which keeps the score at 5.3.
The weakness class is CWE-287 (improper authentication). The record does not mark this CVE as being in the CISA Known Exploited Vulnerabilities catalog, and nothing we could read says it is exploited in the wild.
How to check if you're exposed
Look at the firmware version on each NAS you run.
In QTS or QuTS hero, open Control Panel, then System, then Firmware Update. The installed version and build number are shown there, and the same page can check for a newer build. Compare the build against the fixed list above.
Also check how each device is reachable. A NAS whose admin interface is open to the internet, or to a flat internal network, is a larger risk than one limited to a management segment.
What to do now
- Inventory QNAP devices and their builds.
- Update to QTS 5.1.3.2578 build 20231110 or later, QuTS hero h5.1.3.2578 or later, or QuTScloud c5.1.5.2651 or later. The advisory is QSA-23-33.
- Limit which networks can reach the NAS login page.
- Turn on multi factor authentication for accounts where the device supports it, and review login logs for odd source addresses.
Why it matters
Improper authentication means the system does not properly verify that someone is who they claim to be. The record gives only the general statement that users could compromise the security of the system via a network. The vector shows no privileges and no user interaction, but a low impact limited to confidentiality.
A medium score is easy to push down a patch queue. On an internet reachable device, an authentication flaw is the sort of thing that is worth fixing quickly even at low impact, because it sits at the front door. Keep management interfaces off public networks and apply the update.
Quick check
Is this in the same advisory as CVE-2023-39302?
Both point to QNAP advisory QSA-23-33 in the record, and both list the same fixed builds.
Can an attacker run commands with this?
The record does not say so. It describes a low confidentiality impact only.
Sources
- QNAP security advisory QSA-23-33 (listed in the record; the page returned no readable content when we fetched it, so fixed versions here come from the NVD record, which quotes the advisory text)
- Safeguard Gold entry for CVE-2023-39303
Last reviewed: 19 October 2026.
