CVE-2023-50361 is a Medium severity (CVSS 5.0) buffer copy without checking input size flaw in QNAP QTS and QuTS hero, mapped to a stack based overflow. Authenticated users could execute code over the network. Update to QTS 5.1.6.2722 build 20240402 or QuTS hero h5.1.6.2734 build 20240414.
What's affected
Products: QNAP QTS and QuTS hero. Affected builds named in the record: QTS 5.1.0.2348 (build 20230325), 5.1.0.2399 (build 20230515), 5.1.0.2418 (build 20230603), and QuTS hero h5.1.0.2409 (build 20230525). Fixed: QTS 5.1.6.2722 build 20240402 and later, and QuTS hero h5.1.6.2734 build 20240414 and later, per QNAP advisory QSA-24-20. NVD published the record on 26 April 2024.
The QNAP advisory page is built with scripts and returned no readable text when I fetched it, so the affected and fixed builds below come from the NVD record, which quotes the advisory.
Severity: the record scores it 5.0 (Medium), with vector AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N. I only have the record's score, so I cannot compare it with a separate vendor rating. Note that the description says authenticated users could execute code, while the vector shows limited integrity or availability impact and no confidentiality impact, so the wording and the score do not line up perfectly. Treat the score as the formal rating and the description as a reminder not to ignore it.
The same advisory, QSA-24-20, covers several QTS and QuTS hero issues, including the near identical CVE-2023-50362 and CVE-2023-50364.
How to check if you're exposed
Check the QTS or QuTS hero firmware version in the web interface, under Control Panel, then System, then Firmware Update. The version and build date show on that page.
Compare it with the fixed builds: QTS 5.1.6.2722 build 20240402 or later, and QuTS hero h5.1.6.2734 build 20240414 or later. If your build is older, treat the NAS as affected. The record lists these older builds explicitly: QTS 5.1.0.2348 (build 20230325), 5.1.0.2399 (build 20230515), 5.1.0.2418 (build 20230603) and QuTS hero h5.1.0.2409 (build 20230525). The advisory may name more builds, so use the version comparison, not an exact match.
Then check whether the NAS web interface or any service on it is reachable from the internet. QNAP devices exposed to the internet are a frequent target in general, so reducing exposure is worth doing whatever the CVE says.
Like any appliance, a NAS does not show up in a dependency scan. Keep it in your asset inventory with its firmware build.
What to do now
- Update QTS to 5.1.6.2722 build 20240402 or later, or QuTS hero to h5.1.6.2734 build 20240414 or later, through Firmware Update in Control Panel.
- Take a backup or snapshot before you update, and read the release notes first.
- Remove the NAS from direct internet exposure. Use a VPN for remote access and turn off UPnP port forwarding.
- Review user accounts on the NAS and remove accounts that are unused, since the attacker needs to be logged in.
- Record the new firmware build in your inventory.
Why it matters
The weakness is CWE-120, buffer copy without checking the size of input, and the record also maps it to CWE-121, a stack based buffer overflow. A routine copies data into a buffer without confirming the data fits, so extra bytes overwrite neighboring memory on the stack. QNAP's text says authenticated users could use this to execute code.
The score is modest because an attacker must hold an account and the vector claims only a limited integrity effect. A NAS often stores backups and shared documents, so the real cost of any code execution there can exceed the number. The scope is marked changed, meaning the impact can reach beyond the vulnerable component.
KEV is false, and I found no claim of exploitation. The Gold directory lists this CVE with both CWEs. If your repositories bundle open source libraries, run the free scan at gold.safeguard.sh/scan too.
Quick check
Do I need an account to use this?
Yes. QNAP says authenticated users could exploit it, and the vector shows low privileges.
Which build fixes it?
QTS 5.1.6.2722 build 20240402 and later, or QuTS hero h5.1.6.2734 build 20240414 and later.
Sources
Last reviewed: 19 October 2026.
