CVE-2023-45039 is a low severity buffer copy without size check in several QNAP operating system versions, scored 3.8. Only authenticated administrators can reach it. QNAP lists fixes in QTS 5.1.4.2596 build 20231128 and the matching QuTS hero build, so update.
What's affected
The record says the flaw affects several QNAP operating system versions. Its CPE entries list QTS 5.1.0 builds from March, May and June 2023 and QuTS hero h5.1.0.2409 from May 2023. The fixed versions given in the record text are: QTS 5.1.4.2596 build 20231128 and QuTS hero h5.1.4.2596 build 20231128, each and later.
NVD scores the flaw 3.8, Low, with the vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:L. It needs a network attack, high privileges and no user interaction, with low impact on integrity and availability. The record was published on 2024-01-05 and cites QNAP advisory QSA-23-27.
The advisory page did not render when I fetched it, since it loads through scripts, so the versions above are taken from the advisory text as quoted in the NVD record. Read the advisory for the complete list of affected branches.
The record says the bug could let authenticated administrators execute code via a network. A low score does not mean the bug is harmless: it reflects the high privilege needed first.
Several records from QNAP share almost identical wording. The fixed versions differ between them, so do not assume one update note covers all. Related records: CVE-2023-45035, CVE-2023-45036, CVE-2023-45037, CVE-2023-45040, CVE-2023-45041, CVE-2023-45042, CVE-2023-45043, CVE-2023-45044.
Weakness class: CWE-120 (buffer copy without checking size of input).
How to check if you're exposed
Sign in to the NAS as an administrator, open Control Panel, then System, then Firmware Update, and read the version and build. Compare with the fixed build in the list above. Any QTS 5.1.0 build is inside the range the record lists.
Also review who holds administrator rights on the device. The flaw needs an administrator account, so the fewer there are and the better protected they are, the smaller the real exposure.
What to do now
- Record the QTS or QuTS hero version of every QNAP device you run.
- Update to the fixed build for your branch as listed above, and confirm the version afterwards.
- Check the advisory for the newest recommended build, since later releases may cover several of the related CVEs at once.
- Reduce the number of administrator accounts, turn on two-step verification for them, and avoid shared admin logins.
- Keep the admin interface off the public internet and reach it through a VPN.
Why it matters
The weakness is a buffer copy without checking the size of the input, tracked as CWE-120. A program copies data into a fixed size buffer and does not verify the data fits, so extra bytes spill into memory next to it. That can crash the service or, in the worst case, change what the program does.
The score is low because the attacker must first hold administrator rights. That matters in practice only if those accounts are weak, shared or exposed. In an incident where an admin account has already been stolen, a flaw like this is one more way to dig in. CVE-2023-45039 is not on the CISA Known Exploited Vulnerabilities list, and none of the pages I read says it has been exploited in the wild. That is a statement about what is recorded, not a reason to delay.
Firmware is outside what Safeguard's free in-browser dependency scan reads, since it works on the dependencies in your own code. Keep NAS devices in your hardware and firmware inventory.
Quick check
Which build fixes CVE-2023-45039?
Per the record text: QTS 5.1.4.2596 build 20231128 and QuTS hero h5.1.4.2596 build 20231128, each and later. Confirm in the QNAP advisory.
Why is CVE-2023-45039 rated Low?
The attacker needs administrator rights over the network first, which the score treats as a high barrier.
Sources
- Gold entry for CVE-2023-45039
- QNAP advisory QSA-23-27 (page did not render when fetched; text taken from the NVD record)
Last reviewed: 19 October 2026.
