What’s Vulnerable › Vulnerabilities

CVE-2024-13086: QTS, QuTS hero

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-03-07 · updated 2026-06-17
• Weakness: CWE-200

Description

An exposure of sensitive information vulnerability has been reported to affect product. If exploited, the vulnerability could allow remote attackers to compromise the security of the system. We have already fixed the vulnerability in the following version: QTS 5.2.0.2851 build 20240808 and later QuTS hero h5.2.0.2851 build 20240808 and later

Affected products

• QNAP QTS: from 5.0.0 before 5.2.0.2851 — fixed in 5.2.0.2851
• QNAP Systems Inc. QuTS hero: from h5.0.0 before h5.2.0.2851 — fixed in h5.2.0.2851

How to fix

Upgrade to a fixed version: QNAP QTS 5.2.0.2851; QNAP Systems Inc. QuTS hero h5.2.0.2851. Check the vendor advisory for mitigations.

References

• https://www.qnap.com/en/security-advisory/qsa-25-03

Get alerted when CVE-2024-13086 or the next vulnerability affects your stack