CVE-2024-50403: QNAP QTS Information Disclosure Flaw

CVE-2024-50403 Overview

CVE-2024-50403 is a format string vulnerability affecting multiple versions of QNAP QTS and QuTS hero operating systems. The flaw stems from the use of externally-controlled format strings [CWE-134], allowing input supplied by an attacker to be interpreted as format specifiers by string formatting functions. Exploitation requires prior administrator access to the device. A successful attacker can read secret data from process memory or modify memory contents on the affected NAS appliance. QNAP addressed the issue in QTS 5.2.2.2950 build 20241114 and QuTS hero h5.2.2.2952 build 20241116.

Critical Impact
A remote authenticated administrator can leak secret data from memory or corrupt memory on the QNAP appliance by supplying malicious format specifiers.

Affected Products

QNAP QTS versions prior to 5.2.2.2950 build 20241114
QNAP QuTS hero versions prior to h5.2.2.2952 build 20241116
QNAP NAS appliances running the affected firmware builds listed in QNAP Security Advisory QSA-24-49

Discovery Timeline

2024-12-06 - CVE-2024-50403 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-50403

Vulnerability Analysis

The vulnerability is classified as an externally-controlled format string weakness [CWE-134]. Format string flaws occur when user-supplied input is passed directly as the format argument to functions in the printf family without a fixed format specifier. When an attacker controls that argument, format directives such as %x, %s, or %n are interpreted by the formatting routine. This behavior can be abused to read from arbitrary stack or heap addresses or, with %n, to write attacker-chosen values into memory. Exploitation requires the attacker to already hold administrator credentials on the device, limiting the practical attack surface to post-authentication scenarios.

Root Cause

The root cause is the passing of externally-controlled data as the format string parameter to a C-style formatting function within QTS and QuTS hero components. Because QNAP has not published component-level details, the exact binary and code path are not disclosed in the public advisory.

Attack Vector

An attacker with valid administrator credentials sends crafted input containing format specifiers to an affected interface exposed by QTS or QuTS hero. The formatting routine processes the specifiers, disclosing memory contents in responses or writing values into memory locations pointed to by the format argument stack. The attack is network-reachable but gated by administrator authentication.

See QNAP Security Advisory QSA-24-49 for vendor-provided technical context.

Detection Methods for CVE-2024-50403

Indicators of Compromise

Administrator-authenticated requests containing format specifier sequences such as %x, %s, %n, %p, or long chains of %08x in parameter values or headers
Unexpected crashes, restarts, or memory-related errors in QTS or QuTS hero service logs following administrator activity
Administrator sessions originating from unusual source IPs, geographies, or user agents

Detection Strategies

Inspect QTS and QuTS hero web management logs for request parameters containing repeated % format tokens
Alert on administrator API calls that produce anomalously large response bodies, which may indicate memory disclosure
Correlate administrator authentication events with subsequent configuration or firmware changes to identify potential post-exploitation activity

Monitoring Recommendations

Forward QNAP system, access, and event logs to a central SIEM for retention and analysis
Monitor administrative login attempts and enforce alerting on new or infrequent administrator source addresses
Track firmware version inventory across QNAP appliances to identify hosts still running vulnerable builds

How to Mitigate CVE-2024-50403

Immediate Actions Required

Upgrade QTS to 5.2.2.2950 build 20241114 or later
Upgrade QuTS hero to h5.2.2.2952 build 20241116 or later
Rotate administrator credentials and audit administrator accounts for unauthorized additions
Restrict management interface exposure to trusted networks only

Patch Information

QNAP has released fixed builds for both operating systems. Apply QTS 5.2.2.2950 build 20241114 or later for QTS appliances, and QuTS hero h5.2.2.2952 build 20241116 or later for QuTS hero appliances. Upgrade instructions are provided in QNAP Security Advisory QSA-24-49.

Workarounds

Remove any public exposure of the QNAP administration interface and place management access behind a VPN
Enforce multi-factor authentication for all administrator accounts to raise the bar for reaching the authenticated attack surface
Limit the number of accounts with administrator privileges and review role assignments regularly

bash

# Verify installed firmware version on a QNAP appliance
getcfg System Version -f /etc/config/uLinux.conf
getcfg System "Build Number" -f /etc/config/uLinux.conf