CVE-2023-41292 is a low severity (CVSS 3.8) buffer copy without size check in QNAP QTS, QuTS hero and QuTScloud. An authenticated administrator could use it to execute code over the network. The fix is QTS 5.1.4.2596 build 20231128 or later, or the matching QuTS hero and QuTScloud builds.
What's affected
The NVD record describes the flaw this way: "A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated administrators to execute code via a network." QNAP lists the fixed versions in advisory QSA-23-46 as QTS 5.1.4.2596 build 20231128 and later, QuTS hero h5.1.4.2596 build 20231128 and later, and QuTScloud c5.1.5.2651 and later.
The NVD product data names QTS 5.1.0 builds (2348, 2399 and 2418), and the description says "several QNAP operating system versions". Treat QTS, QuTS hero and QuTScloud releases older than the fixed builds as affected until QNAP says otherwise. It is separate from the buffer copy CVEs in QSA-23-38 and is fixed under QSA-23-46.
QNAP's site blocked our automated request, so this post relies on the record's own text for the version list. Check the advisory for the full table.
The record scores the flaw 3.8 (Low) with the vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:L. It can be reached over the network, the attack complexity is low, it requires high privileges (an administrator account), and it needs no user interaction. The impact on confidentiality is no, on integrity low and on availability low. The weakness class is CWE-120 (buffer copy without checking size of input). The record does not mark this CVE as being in the CISA Known Exploited Vulnerabilities catalog, and nothing we read says it is exploited in the wild.
How to check if you're exposed
Sign in to the QTS or QuTS hero admin interface and open the firmware update page to see the installed version and build number. Compare it with the fixed builds above. For QuTScloud, check the version of the cloud instance the same way.
Then check who holds an administrator account on the device. The record says exploitation needs an authenticated administrator, so the number of admin accounts and their password hygiene are the practical measure of exposure.
What to do now
- Update the device to a fixed build: QTS 5.1.4.2596 build 20231128 and later, QuTS hero h5.1.4.2596 build 20231128 and later, and QuTScloud c5.1.5.2651 and later.
- Read QNAP advisory QSA-23-46 for any steps the record does not include.
- Reduce the number of administrator accounts and give each a strong, unique password, with two step verification where available.
- Keep the admin interface off the public internet; reach it through a VPN or an allow list.
Why it matters
The weakness is CWE-120, a buffer copy without a size check. Data is copied into a fixed size memory area without confirming it fits, which can overwrite nearby memory. The record says code execution would need an authenticated administrator.
The score is the lowest of the QNAP set (3.8) because the vector shows high privileges are needed and the confidentiality impact is none. It is still worth taking in the same firmware update that fixes the other advisories.
Quick check
Do I need to be an administrator to trigger this?
The record says the attacker is an authenticated administrator. That lowers the score, but admin accounts are a common target, so still update.
Which builds fix it?
QTS 5.1.4.2596 build 20231128 and later, QuTS hero h5.1.4.2596 build 20231128 and later, and QuTScloud c5.1.5.2651 and later. Confirm in QSA-23-46.
Sources
- QNAP advisory QSA-23-46 (linked from the NVD record; access was blocked when we reviewed it)
- CVE-2023-41292 on Gold
Last reviewed: 19 October 2026.
