CVE-2023-51367 is a medium severity (CVSS 5.4) buffer copy without checking input size in QNAP QTS and QuTS hero 5.1.x. QNAP says remote attackers who already have user access could execute code. The fixed builds are QTS 5.1.6.2722 and QuTS hero h5.1.6.2734, and later.
What's affected
QNAP's advisory QSA-24-20 lists QTS 5.1.x and QuTS hero h5.1.x as affected. The fixed versions are QTS 5.1.6.2722 build 20240402 and later, and QuTS hero h5.1.6.2734 build 20240414 and later. The NVD record gives the same versions.
The record and advisory agree on severity: NVD scores 5.4 (Medium) and QNAP rates the advisory Moderate. The advisory groups this CVE with CVE-2023-50361, CVE-2023-50362 and CVE-2023-50364 and does not give a separate score or technical detail for this one.
CVSS for this entry is 5.4 (Medium) with vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:L.
How to check if you're exposed
Open Control Panel, System, Firmware Update on the QNAP device and read the installed build. QTS 5.1.x earlier than 5.1.6.2722, or QuTS hero h5.1.x earlier than h5.1.6.2734, is in range.
QNAP says the attacker needs user access, so the number and trust level of accounts on the NAS matters. The NVD vector also shows high attack complexity.
What to do now
- Read the firmware build on each QNAP NAS running 5.1.x.
- Update to the latest firmware, or at least QTS 5.1.6.2722 or QuTS hero h5.1.6.2734, using Live Update or a manual download from the Download Center.
- Check QNAP's product support status page to confirm updates exist for your model.
- Remove unused accounts and avoid exposing the NAS directly to the internet.
- Run the free in-browser dependency scan at gold.safeguard.sh/scan against your manifests, and look the entry up in the Safeguard Gold directory to see how it is tracked.
Why it matters
CWE-120 is a classic buffer copy without checking the size of the input. Data larger than the destination overwrites adjacent memory. The fix is to check lengths before copying, or to use APIs that enforce bounds.
CWE-121 is a stack-based buffer overflow, where the overwritten memory sits on the call stack. Bounds checks before the copy remove the problem.
Two CWE entries apply. CWE-120 is a buffer copy without checking the size of the input, and CWE-121 is the stack based variant. Data longer than the destination overwrites adjacent memory, which can crash the service or allow code to run.
The medium score reflects the need for existing user access and high attack complexity, with a changed scope. Still, code execution on a storage device is worth a routine patch window.
The record does not mark this CVE as listed in the CISA Known Exploited Vulnerabilities catalog, and no source I read reports exploitation in the wild.
Quick check
Is this the same as the path traversal CVEs?
No. Those are CVE-2023-51364 and CVE-2023-51365 in a different advisory with different fixed builds.
Does QNAP say it is exploited?
The advisory I read does not.
Sources
Last reviewed: 19 October 2026.
