CVE-2024-50399: QNAP QTS Information Disclosure Flaw

CVE-2024-50399 Overview

CVE-2024-50399 is an externally-controlled format string vulnerability affecting QNAP QTS and QuTS hero operating systems. The flaw is classified under [CWE-134] and allows remote attackers who have already obtained administrator access to read secret data from memory or modify memory contents. QNAP addressed the issue in QTS 5.2.1.2930 build 20241025 and QuTS hero h5.2.1.2929 build 20241025. Exploitation requires high privileges and network access, which limits practical attack scenarios. QNAP disclosed the issue through security advisory QSA-24-43.

Critical Impact
An authenticated administrator can leverage the format string flaw to disclose sensitive memory contents or corrupt process memory on affected QNAP NAS devices.

Affected Products

QNAP QTS versions prior to 5.2.1.2930 build 20241025
QNAP QuTS hero versions prior to h5.2.1.2929 build 20241025
QTS and QuTS hero 5.2.0.x builds released between April and August 2024

Discovery Timeline

2024-11-22 - CVE-2024-50399 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-50399

Vulnerability Analysis

The vulnerability is a use of externally-controlled format string, categorized under [CWE-134]. When a program passes user-controlled input directly to a formatting function such as printf, sprintf, or syslog without a fixed format specifier, an attacker can supply conversion specifiers like %x, %s, or %n. These specifiers cause the function to read from or write to memory locations that were not intended to be exposed.

On affected QNAP operating systems, an authenticated administrator can inject format specifiers into a parameter processed by a vulnerable formatting routine. This allows the attacker to leak memory contents such as stack values, pointers, or secrets, and in some cases write to arbitrary memory addresses. The attack requires network access to the NAS management interface.

Root Cause

The root cause is the passing of externally supplied input as the format string argument to a C library formatting function. Secure code passes user input as a data argument with a fixed format string, for example printf("%s", user_input) rather than printf(user_input). QNAP did not disclose the specific component or binary affected in advisory QSA-24-43.

Attack Vector

The attack vector is network-based but gated by administrator authentication. An attacker must first obtain valid administrator credentials, for example through credential theft, phishing, or reuse of exposed credentials. Once authenticated, the attacker submits crafted input containing format specifiers to the vulnerable interface. The formatting function then dereferences attacker-controlled specifiers, resulting in memory disclosure or memory modification within the target process.

Detection Methods for CVE-2024-50399

Indicators of Compromise

Administrator session activity followed by unexpected process crashes or segfault entries in system logs on the NAS.
HTTP requests to QNAP management endpoints containing format specifier sequences such as %x, %s, %n, or %p in parameter values.
Unusual outbound data flows from the NAS after administrator authentication that may indicate memory exfiltration.

Detection Strategies

Inspect QTS and QuTS hero web administration logs for parameters containing format specifier tokens.
Correlate administrator logins from anomalous source IP addresses with subsequent configuration or diagnostic activity.
Monitor for repeated authentication attempts against QNAP administrator accounts that may precede exploitation.

Monitoring Recommendations

Forward QNAP system and access logs to a central SIEM for retention and query.
Alert on any administrator account activity outside expected maintenance windows or from new geolocations.
Track NAS process health metrics to identify crashes consistent with format string corruption.

How to Mitigate CVE-2024-50399

Immediate Actions Required

Upgrade QTS to 5.2.1.2930 build 20241025 or later, and QuTS hero to h5.2.1.2929 build 20241025 or later.
Rotate all administrator credentials on affected NAS devices and enforce multi-factor authentication.
Restrict administrator interface access to trusted management networks using firewall or VPN controls.

Patch Information

QNAP fixed the vulnerability in QTS 5.2.1.2930 build 20241025 and QuTS hero h5.2.1.2929 build 20241025. Administrators should apply the update through the Control Panel Firmware Update option or download the firmware from the QNAP download center. Full patch guidance is published in QNAP Security Advisory QSA-24-43.

Workarounds

Disable remote administrator access from untrusted networks until the patch is applied.
Remove or disable unused administrator accounts and audit remaining accounts for least privilege.
Place the NAS management interface behind a VPN or reverse proxy that enforces additional authentication.

bash

# Verify installed QTS or QuTS hero version via SSH
getcfg system version
getcfg system buildnumber

# Expected minimum patched versions:
# QTS:        5.2.1.2930 build 20241025
# QuTS hero:  h5.2.1.2929 build 20241025