CVE-2023-51070 is a high severity (CVSS 7.5) access control flaw in QStar Archive Solutions Release 3-0 Build 7 Patch 0. Unauthenticated attackers can change sensitive SMB settings on the server. The record names no fix, so contact QStar and restrict network access.
What's affected
The NVD record lists QStar Archive Solutions (Archive Storage Manager) Release 3-0, Build 7, Patch 0 as affected. The description says an access control issue allows unauthenticated attackers to arbitrarily adjust sensitive SMB settings on the QStar Server.
The record names no fixed release, and the only reference is a researcher write-up on GitHub that I did not load. Check with QStar for a patched build and ask for their advisory.
CVSS for this entry is 7.5 (High) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N.
How to check if you're exposed
Look in the product's about or system information page for the release string. A match on Release 3-0 Build 7 Patch 0 means you are in scope of the record. Review the server's current SMB share and access settings against your last known good configuration, since an unauthorized change would be the visible sign.
Because the record lists no CWE-specific fix guidance, the most useful check is network reachability: can systems outside your storage administration network reach the QStar server's web service?
What to do now
- Identify QStar Archive Solutions servers and confirm the release, build and patch level.
- Ask QStar whether a build newer than Build 7 Patch 0 fixes this CVE, and apply it when available.
- Restrict network access to the QStar web interface and services to the administrators and systems that need them.
- Review the server's access logs and configuration for changes you did not make, then record the outcome.
- Run the free in-browser dependency scan at gold.safeguard.sh/scan against your manifests, and look the entry up in the Safeguard Gold directory to see how it is tracked.
Why it matters
CWE-284 is improper access control. A function that should require authorization can be reached by someone who has not been granted it. The fix is to enforce authentication and authorization on every sensitive endpoint, not just on the pages that link to it.
The weakness is CWE-284, improper access control. A function that changes configuration is reachable without authentication. The NVD vector shows network access, no privileges or interaction, and a high integrity impact only.
Changed file sharing settings can expose archived data to other hosts, so the downstream effect can be larger than the integrity label suggests. Nothing I read reports exploitation.
The record does not mark this CVE as listed in the CISA Known Exploited Vulnerabilities catalog, and no source I read reports exploitation in the wild.
Quick check
What does the attacker change?
Sensitive SMB settings on the QStar server, per the description.
Is there a fix?
The record names none.
Sources
Last reviewed: 19 October 2026.
