CVE-2023-50362 is a Medium severity (CVSS 5.0) buffer copy without checking input size flaw in QNAP QTS and QuTS hero, mapped to a stack based overflow. It is a sibling of CVE-2023-50361 in the same QNAP advisory. Update to QTS 5.1.6.2722 build 20240402 or QuTS hero h5.1.6.2734 build 20240414.
What's affected
Products: QNAP QTS and QuTS hero. Affected builds named in the record: QTS 5.1.0.2348 (build 20230325), 5.1.0.2399 (build 20230515), 5.1.0.2418 (build 20230603), and QuTS hero h5.1.0.2409 (build 20230525). Fixed: QTS 5.1.6.2722 build 20240402 and later, and QuTS hero h5.1.6.2734 build 20240414 and later, per QNAP advisory QSA-24-20. NVD published the record on 26 April 2024.
The QNAP advisory page is built with scripts and returned no readable text when I fetched it, so the affected and fixed builds below come from the NVD record, which quotes the advisory.
Severity: the record scores it 5.0 (Medium), with vector AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N. I only have the record's score, so I cannot compare it with a separate vendor rating. Note that the description says authenticated users could execute code, while the vector shows limited integrity or availability impact and no confidentiality impact, so the wording and the score do not line up perfectly. Treat the score as the formal rating and the description as a reminder not to ignore it.
The same advisory, QSA-24-20, covers several QTS and QuTS hero issues, including CVE-2023-50361 and CVE-2023-50364.
How to check if you're exposed
Check the QTS or QuTS hero firmware version in the web interface, under Control Panel, then System, then Firmware Update. The version and build date show on that page.
Compare it with the fixed builds: QTS 5.1.6.2722 build 20240402 or later, and QuTS hero h5.1.6.2734 build 20240414 or later. If your build is older, treat the NAS as affected. The record lists these older builds explicitly: QTS 5.1.0.2348 (build 20230325), 5.1.0.2399 (build 20230515), 5.1.0.2418 (build 20230603) and QuTS hero h5.1.0.2409 (build 20230525). The advisory may name more builds, so use the version comparison, not an exact match.
Then check whether the NAS web interface or any service on it is reachable from the internet. QNAP devices exposed to the internet are a frequent target in general, so reducing exposure is worth doing whatever the CVE says.
Like any appliance, a NAS does not show up in a dependency scan. Keep it in your asset inventory with its firmware build.
What to do now
- Update QTS to 5.1.6.2722 build 20240402 or later, or QuTS hero to h5.1.6.2734 build 20240414 or later, through Firmware Update in Control Panel.
- Take a backup or snapshot before you update, and read the release notes first.
- Remove the NAS from direct internet exposure. Use a VPN for remote access and turn off UPnP port forwarding.
- Review user accounts on the NAS and remove accounts that are unused, since the attacker needs to be logged in.
- Record the new firmware build in your inventory.
Why it matters
The weakness is CWE-120, buffer copy without checking the size of input, with the CWE-121 stack based overflow mapping. The NVD record for this CVE is word for word the same as CVE-2023-50361, which means QNAP reported two separate flaws in different places with the same class and score. The sources I have do not say which component each one lives in.
For defenders that has one practical meaning: you do not need to track them separately. One firmware update closes both, along with the rest of the advisory.
Memory safety bugs in appliance firmware are common because the code is written in C and runs close to the hardware. Authentication limits who can reach them, but accounts on shared storage tend to be plentiful. KEV is false and no source claims exploitation. The free scan at gold.safeguard.sh/scan covers the dependencies in your own code, while the Gold directory lists this CVE and its CWEs.
Quick check
How is this different from CVE-2023-50361?
The record text and score are identical. They are separate CVE identifiers for separate flaws in the same advisory, and the same firmware update fixes both.
Is it exploited?
The KEV flag is false and the sources I read do not claim exploitation.
Sources
Last reviewed: 19 October 2026.
