CVE-2023-41273 is a medium severity (CVSS 5.5) heap-based buffer overflow in QNAP QTS, QuTS hero and QuTScloud. An authenticated administrator could use it to run code over the network. The fix is QTS 5.1.2.2533 build 20230926 or later, or the matching QuTS hero and QuTScloud builds.
What's affected
The NVD record describes the flaw this way: "A heap-based buffer overflow vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated administrators to execute code via a network." QNAP lists the fixed versions in advisory QSA-23-38 as QTS 5.1.2.2533 build 20230926 and later, QuTS hero h5.1.2.2534 build 20230927 and later, and QuTScloud c5.1.5.2651 and later.
The NVD product data names QTS 5.1.0 builds (2348, 2399 and 2418), and the description says "several QNAP operating system versions". Treat QTS, QuTS hero and QuTScloud releases older than the fixed builds as affected until QNAP says otherwise. It is one of several buffer overflow CVEs (CVE-2023-41275 to CVE-2023-41280) fixed in the same advisory.
QNAP's site blocked our automated request, so this post relies on the record's own text for the version list. Check the advisory for the full table.
The record scores the flaw 5.5 (Medium) with the vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:L/A:L. It can be reached over the network, the attack complexity is low, it requires high privileges (an administrator account), and it needs no user interaction. The impact on confidentiality is no, on integrity low and on availability low. The scope is marked as changed, meaning the damage can reach beyond the vulnerable component. The weakness classes are CWE-120 (buffer copy without checking size of input), CWE-122 (heap-based buffer overflow) and CWE-787 (out-of-bounds write). The record does not mark this CVE as being in the CISA Known Exploited Vulnerabilities catalog, and nothing we read says it is exploited in the wild.
How to check if you're exposed
Sign in to the QTS or QuTS hero admin interface and open the firmware update page to see the installed version and build number. Compare it with the fixed builds above. For QuTScloud, check the version of the cloud instance the same way.
Then check who holds an administrator account on the device. The record says exploitation needs an authenticated administrator, so the number of admin accounts and their password hygiene are the practical measure of exposure.
What to do now
- Update the device to a fixed build: QTS 5.1.2.2533 build 20230926 and later, QuTS hero h5.1.2.2534 build 20230927 and later, and QuTScloud c5.1.5.2651 and later.
- Read QNAP advisory QSA-23-38 for any steps the record does not include.
- Reduce the number of administrator accounts and give each a strong, unique password, with two step verification where available.
- Keep the admin interface off the public internet; reach it through a VPN or an allow list.
Why it matters
These are buffer overflow weaknesses: code copies more data into a memory buffer than it can hold, and the neighbouring bytes get overwritten. That can corrupt memory and, in the worst case, let an attacker run code. The record says the code execution path needs an authenticated administrator.
On a NAS, memory safety bugs in the operating system matter because the device often holds backups and shared files for a whole team. Even a medium score deserves a firmware update on a schedule you control, rather than a long delay.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Do I need to be an administrator to trigger this?
The record says the attacker is an authenticated administrator. That lowers the score, but admin accounts are a common target, so still update.
Which builds fix it?
QTS 5.1.2.2533 build 20230926 and later, QuTS hero h5.1.2.2534 build 20230927 and later, and QuTScloud c5.1.5.2651 and later. Confirm in QSA-23-38.
Sources
- QNAP advisory QSA-23-38 (linked from the NVD record; access was blocked when we reviewed it)
- CVE-2023-41273 on Gold
Last reviewed: 19 October 2026.
