iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
QNAP’s January 2024 patch roundup covered 12 vulnerabilities across QTS, QuTS hero, Netatalk, Video Station, QuMagie, and QcalAgent. The reported fixes included operating-system builds for prototype pollution and a Netatalk remote-code-execution flaw, plus updates to Video Station and QuMagie. These are historical versions, not confirmation of the latest updates available today; check QNAP’s current advisory and support information for your NAS model before installing an update.
What QNAP patched in the January 2024 roundup
SecurityWeek reported on January 8, 2024, that QNAP had addressed a dozen vulnerabilities across its product portfolio. The roundup highlighted high-severity flaws in QTS and QuTS hero, Video Station, and QuMagie. It also said the operating-system updates addressed a Netatalk vulnerability. Medium- and low-severity issues affected QTS, QuTS hero, QuMagie, and QcalAgent.
| # | Preview | Product | Price | |
|---|---|---|---|---|
| 1 |
|
QNAP TS-216G-US 2-Bay 2.5GbE Desktop NAS | $299.00 | Buy on Amazon |
| 2 |
|
QNAP TS-264-8G-US 2 Bay Desktop NAS | $399.00 | Buy on Amazon |
| 3 |
|
QNAP TS-233-US 2 Bay Desktop NAS | $239.00 | Buy on Amazon |
| 4 |
|
QNAP TS-464-8G-US 4 Bay Desktop NAS | Buy on Amazon |
The versions below are those named in that 2024 report. They establish what was reported as fixed then; they do not establish which releases are currently supported or appropriate for a particular NAS.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Highlighted vulnerabilities and reported fixes
| Component | Vulnerability | Reported impact or access condition | Fix reported in January 2024 |
|---|---|---|---|
| QTS 5.1.x and QuTS hero h5.1.x | CVE-2023-39296, prototype pollution | Remote attackers could override existing attributes with incompatible types, potentially causing a system crash. | QTS 5.1.3.2578 build 20231110 and later; QuTS hero h5.1.3.2578 build 20231110 and later. |
| Netatalk in QTS and QuTS hero | CVE-2022-43634, remote code execution | SecurityWeek characterized the flaw as allowing unauthenticated remote code execution. | The report says the QTS and QuTS hero updates listed above addressed it. |
| Video Station | CVE-2023-41287, SQL injection; CVE-2023-41288, OS command injection | SQL injection and OS command injection flaws. | Video Station 5.7.2. |
| QuMagie | CVE-2023-47559, cross-site scripting; CVE-2023-47560, OS command injection | Cross-site scripting and OS command injection flaws. | QuMagie 2.2.1. |
For CVE-2023-39296, SecurityWeek quoted QNAP’s advisory as saying attackers could “override existing attributes with ones that have an incompatible type, which may cause the system to crash.” The report did not describe the highlighted issues as having been exploited in the wild at the time of publication; that is not a current threat assessment.
#1 Best Overall
- ARM Cortex-A55 quad-core 2.0GHz processor with 4 GB DDR4 RAM
- Built-in NPU for AI Acceleration to boost performance for high-speed face and object recognition.
- 2.5GbE (2.5G/1G/100M) ports accelerates file sharing across teams and devices or streamline large file transfers
- Budget-friendly Home NAS for file storage and multimedia streaming
- Centrally store and organize personal or family photos, music, and videos
How to interpret the Netatalk mitigation
QNAP’s separate advisory QSA-22-12 concerns historical Netatalk vulnerabilities, including CVE-2022-43634. It lists affected and fixed builds across QTS, QuTS hero, and QuTScloud branches, and recommends disabling AFP as a mitigation. That advice is specific to the Netatalk issues in that advisory, not a general remedy for the other vulnerabilities in the 2024 roundup. If AFP is needed in your environment, weigh the mitigation against that dependency and follow QNAP’s advisory for the NAS and firmware branch you use.
The 2024 report’s operating-system build references should not be confused with the older advisory’s branch-specific build details. Use the exact QNAP advisory applicable to your model and software branch rather than treating one branch’s version as universal.
Rank #2
- Intel Quad-core CPU burst up to 2.9 GHz with 8GB RAM
- Dual 2.5GbE (2.5G/1G/100M) ports accelerates file sharing across teams and devices or streamline large file transfers
- Dual M.2 PCIe Gen3x2 NVMe SSD slots enable cache acceleration or SSD storage pools for improved performance
- Multiple USB 3.2 Gen 2 ports (type-A) with up to 10Gb/s transfer speeds, allowing compatibility with newer, faster USB drives/expansion enclosures for transferring large media files
- Centrally store and organize personal or family photos, music, and videos
What NAS owners should do now
- Identify the NAS model and its installed QTS or QuTS hero branch, and check whether Video Station, QuMagie, or AFP/Netatalk is in use.
- Open QNAP’s current security advisories and model-specific support information to find an update applicable to that device and software branch.
- Install the current applicable update using QNAP’s instructions. Do not assume that the historical 2024 builds are the latest available or that every model supports them.
- If the NAS uses AFP, consult QSA-22-12 for its Netatalk-specific mitigation guidance and decide whether AFP can be disabled without disrupting required access.
The historical roundup does not establish current support status for every NAS model or current fixed versions for all affected products. QNAP’s current security advisories and support details should guide present-day update decisions.
Do not confuse these Video Station fixes with an older advisory
QNAP’s 2021 advisory for CVE-2021-28812 named Video Station fixes for QTS 4.5.2, QuTS hero h4.5.2, and QuTScloud c4.5.4. That is a different vulnerability from the 2023 SQL-injection and OS-command-injection flaws fixed in Video Station 5.7.2, so those version references are not interchangeable.
Quick Recap
Rank #4
- Quad-core Intel N5105/N5095 4-core/4-thread burst up to 2.9 GHz with 8GB DDR4 RAM
- Dual 2.5GbE (2.5G/1G/100M) ports accelerates file sharing across teams and devices or streamline large file transfers
- Dual M.2 PCIe Gen3x2 NVMe SSD slots enable cache acceleration or SSD storage pools for improved performance
- Multiple USB 3.2 Gen 2 ports (type-A) with up to 10Gb/s transfer speeds, allowing compatibility with newer, faster USB drives/expansion enclosures for transferring large media files
- Centrally store and organize personal or family photos, music, and videos
Rank #3
- ARM Cortex-A55 quad-core 2.0GHz processor with 2 GB DDR4 RAM
- Budget-friendly Home NAS for file storage and multimedia streaming
- Centrally store and organize personal or family photos, music, and videos
- Mitigate the threat of ransomware with QNAP's storage snapshot technology
- Effortlessly backup your Windows Computers with QNAP’s NetBak Replicator software and Mac computers with Time Machine
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
