CVE-2024-53691: QNAP QTS Path Traversal Vulnerability

CVE-2024-53691 Overview

CVE-2024-53691 is a link following vulnerability [CWE-59] affecting multiple versions of QNAP QTS and QuTS hero operating systems. The flaw allows remote attackers with authenticated user access to traverse the file system to unintended locations by abusing symbolic link resolution. QNAP disclosed the issue in security advisory QSA-24-28 and released fixed builds for both operating system families.

Critical Impact
Authenticated remote attackers can leverage symbolic link handling flaws to access files outside intended directory boundaries, exposing sensitive data and system files on affected QNAP network-attached storage (NAS) devices.

Affected Products

QNAP QTS versions prior to 5.1.8.2823 build 20240712 and 5.2.0.2802 build 20240620
QNAP QuTS hero versions prior to h5.1.8.2823 build 20240712 and h5.2.0.2802 build 20240620
QNAP NAS appliances running the vulnerable operating system builds

Discovery Timeline

2024-12-06 - CVE-2024-53691 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-53691

Vulnerability Analysis

The vulnerability resides in how QTS and QuTS hero resolve symbolic links during file system operations. An authenticated attacker can create or manipulate links that point outside of intended directory boundaries. When the operating system follows those links, it grants access to resources that should be restricted by path or permission checks.

The flaw affects the network-facing management surface of the NAS. Successful exploitation delivers high confidentiality, integrity, and availability impact against the affected system scope, as reflected in the CVSS 4.0 vector. The EPSS score of 20.112% (97.245 percentile) indicates a meaningfully elevated likelihood of exploit activity compared to the general CVE population.

Root Cause

The root cause is improper handling of symbolic and hard links [CWE-59], commonly referred to as a link following weakness. File system routines dereference user-controlled links without validating that the resolved target remains within an authorized directory tree. This bypasses the access controls that would normally isolate user data from system paths.

Attack Vector

Exploitation requires network access to the QNAP device and valid low-privilege user credentials. No user interaction is required. The attacker plants a symbolic link within a writable location, then triggers a QTS or QuTS hero operation that follows the link. The service then reads, writes, or executes against the attacker-chosen target path outside the sandboxed directory.

No public proof-of-concept exploit code has been published for CVE-2024-53691. Consult the QNAP Security Advisory QSA-24-28 for vendor technical details.

Detection Methods for CVE-2024-53691

Indicators of Compromise

Unexpected symbolic links appearing inside user shares, especially links pointing to /etc, /mnt, or other system paths
QTS or QuTS hero access logs showing authenticated users reading or writing files outside their assigned share paths
Anomalous file operations initiated from low-privilege accounts against sensitive configuration files
New or modified files under system directories following legitimate user share activity

Detection Strategies

Audit share directories for symbolic links whose target paths resolve outside the share root
Correlate NAS authentication events with subsequent file access patterns that traverse directory boundaries
Monitor for file access sequences where a link creation is quickly followed by a read or write against an unusual path
Track privilege boundaries by comparing effective file access paths against the user's assigned share permissions

Monitoring Recommendations

Forward QTS and QuTS hero system logs, connection logs, and event logs to a centralized log platform for retention and analysis
Alert on creation of symbolic links inside shared folders by non-administrative accounts
Baseline normal user access patterns and flag deviations that touch operating system paths
Review administrative accounts for unexpected logins that could precede exploitation attempts

How to Mitigate CVE-2024-53691

Immediate Actions Required

Upgrade QTS to build 5.1.8.2823 (20240712) or 5.2.0.2802 (20240620) or later immediately
Upgrade QuTS hero to build h5.1.8.2823 (20240712) or h5.2.0.2802 (20240620) or later immediately
Rotate credentials for all QNAP user and administrator accounts if compromise is suspected
Restrict management interface exposure to trusted networks and remove direct internet exposure of the NAS admin panel

Patch Information

QNAP released fixed versions in QSA-24-28. Apply QTS 5.1.8.2823 build 20240712 or later, QTS 5.2.0.2802 build 20240620 or later, QuTS hero h5.1.8.2823 build 20240712 or later, or QuTS hero h5.2.0.2802 build 20240620 or later. Updates are delivered through the QTS Control Panel under Firmware Update or via the QNAP download center.

Workarounds

Disable non-essential services and remote access features until the firmware update can be applied
Enforce least-privilege share permissions and revoke write access from accounts that do not require it
Place the NAS behind a VPN or firewall segment to remove exposure to untrusted networks
Enable two-step verification on all administrative accounts to reduce the risk of credential-based access

bash

# Verify installed QTS or QuTS hero build after upgrade
getcfg System Version -f /etc/config/uLinux.conf
getcfg System "Build Number" -f /etc/config/uLinux.conf