QNAP Systems, Inc. QuTS hero

Name: QNAP Systems, Inc. QuTS hero
Brand: QNAP Systems, Inc.

productRU

A product tracked in the threat graph; the vulnerabilities below are known to affect it.

by severity

10critical61high14medium2low

updated 2026-10-27

vulnerabilities (90)

Related CVEs.

sort

ID	severity	EPSS	exploitable	patched	published	affected
CVE-2020-2509US	critical9.8OT critical	34.0% (98th)	KEV	no fix	2021-04-17	≤ h4.5.1.1491 build 20201119
CVE-2023-47218US	high8.3	89.9% (100th)	Exploit	no fix	2024-02-13	2 versions
CVE-2024-27130US	high8.8	37.5% (99th)	Exploit	no fix	2024-05-21	—
CVE-2024-53691US	high8.8	23.8% (98th)	Exploit	no fix	2024-12-06	h5.1.0 → h5.2.0.2802 build 20240620
CVE-2024-21899US	critical9.8	24.4% (98th)	—	no fix	2024-03-08	2 versions
CVE-2023-23368US	critical9.8	18.7% (97th)	—	no fix	2023-11-03	2 versions
CVE-2024-21901US	medium4.7	18.7% (97th)	—	no fix	2024-03-08	2 versions
CVE-2023-50358US	—	13.5% (96th)	—	no fix	2024-02-13	2 versions
CVE-2024-21900US	medium6.5	9.41% (95th)	—	no fix	2024-03-08	2 versions
CVE-2022-27596US	critical9.8	2.66% (86th)	—	no fix	2023-01-30	≤ h5.0.1.2248 build 20221215
CVE-2020-25847US	high8.8	2.58% (85th)	—	no fix	2020-12-29	≤ h4.5.1.1491
CVE-2024-32766US	—	2.31% (83rd)	—	no fix	2024-04-26	2 versions
CVE-2021-34343US	high7.2	1.95% (80th)	—	no fix	2021-09-10	≤ h4.5.4.1771
CVE-2021-44051US	high8.8	1.66% (77th)	—	no fix	2022-05-05	2 versions
CVE-2023-23362US	high8.8	1.60% (76th)	—	no fix	2023-09-22	2 versions
CVE-2021-44052US	high8.1	1.59% (76th)	—	no fix	2022-05-05	2 versions
CVE-2021-34344US	critical9.8	1.58% (75th)	—	no fix	2021-09-10	≤ h4.5.3
CVE-2023-39296US	high7.5	1.56% (75th)	—	no fix	2024-01-05	h5.1.0 → h5.1.3.2578 build 20231110
CVE-2023-23367US	high7.2	1.50% (74th)	—	no fix	2023-11-10	h5.0.0 → h5.0.1.2376 build 20230421
CVE-2023-39297US	high8.8	1.41% (72nd)	—	no fix	2024-02-02	2 versions
CVE-2024-50393US	critical9.8	1.31% (70th)	—	no fix	2024-12-06	2 versions
CVE-2023-23355US	high7.2	1.23% (69th)	—	no fix	2023-03-29	≤ h5.0.1.2348 build 20230324
CVE-2023-47566US	high7.2	1.18% (67th)	—	no fix	2024-02-02	≤ h5.1.5.2647 build 20240118
CVE-2023-45025US	critical9.8	1.13% (66th)	—	no fix	2024-02-02	2 versions
CVE-2023-39294US	high7.2	1.12% (66th)	—	no fix	2024-01-05	h5.1.0 → h5.1.3.2578 build 20231110
CVE-2023-47567US	high7.2	1.11% (66th)	—	no fix	2024-02-02	2 versions
CVE-2023-39302US	high7.2	1.07% (65th)	—	no fix	2024-02-02	h5.1.0 → h5.1.3.2578 build 20231110
CVE-2023-34974US	high8.8	0.99% (62nd)	—	no fix	2024-09-06	h4.5.0 → h4.5.4.2790 build 20240606
CVE-2023-41283US	high7.2	0.97% (62nd)	—	no fix	2024-02-02	h5.1.0 → h5.1.4.2596 build 20231128
CVE-2023-41282US	high7.2	0.97% (62nd)	—	no fix	2024-02-02	h5.1.0 → h5.1.4.2596 build 20231128
CVE-2023-41281US	high7.2	0.97% (62nd)	—	no fix	2024-02-02	h5.1.0 → h5.1.4.2596 build 20231128
CVE-2025-62849US	critical9.8	0.97% (62nd)	—	no fix	2025-12-16	2 versions
CVE-2021-38693US	medium5.3	0.95% (61st)	—	no fix	2022-05-05	≤ h5.0.0.1949
CVE-2021-28816US	high8.8	0.93% (60th)	—	no fix	2021-09-10	≤ h4.5.4.1771
CVE-2023-32975US	high7.2	0.87% (59th)	—	no fix	2023-12-08	2 versions
CVE-2025-62848US	high7.5	0.86% (58th)	—	no fix	2025-12-16	2 versions
CVE-2023-50364US	high8.8	0.85% (58th)	—	no fix	2024-04-26	h5.1 → h5.1.6.2734 build 20240414
CVE-2025-62847US	high7.5	0.82% (57th)	—	no fix	2025-12-16	2 versions
CVE-2023-32968US	high7.2	0.76% (55th)	—	no fix	2023-12-08	2 versions
CVE-2023-50362US	high8.8	0.76% (55th)	—	no fix	2024-04-26	h5.1 → h5.1.6.2734 build 20240414
CVE-2023-50361US	high8.8	0.76% (55th)	—	no fix	2024-04-26	h5.1 → h5.1.6.2734 build 20240414
CVE-2021-44053US	medium6.1	0.76% (55th)	—	no fix	2022-05-05	2 versions
CVE-2023-32974US	high7.5	0.73% (54th)	—	no fix	2023-10-13	h5.1.0 → h5.1.0.2424 build 20230609
CVE-2024-27127US	high8.8	0.70% (53rd)	—	no fix	2024-05-21	h5.1.0 → h5.1.7.2770 build 20240520
CVE-2024-27129US	high8.8	0.69% (53rd)	—	no fix	2024-05-21	h5.1.0 → h5.1.7.2770 build 20240520
CVE-2024-27128US	high8.8	0.69% (53rd)	—	no fix	2024-05-21	h5.1.0 → h5.1.7.2770 build 20240520
CVE-2022-27598US	low2.7	0.66% (51st)	—	no fix	2023-03-29	≤ h5.0.1.2348 build 20230324
CVE-2022-27597US	low2.7OT elevated	0.66% (51st)	—	no fix	2023-03-29	≤ h5.0.1.2348 build 20230324
CVE-2023-45044US	high7.2	0.64% (50th)	—	no fix	2024-01-05	h5.1.0 → h5.1.4.2596 build 20231128
CVE-2023-45043US	high7.2	0.64% (50th)	—	no fix	2024-01-05	h5.1.0 → h5.1.4.2596 build 20231128

showing 50 of 90

weaknesses (8)

The flaw types (CWEs) most of these CVEs share.

CWE-120Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')29 CVEs
CWE-78Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')20 CVEs
CWE-121Stack-based Buffer Overflow14 CVEs
CWE-77Improper Neutralization of Special Elements used in a Command ('Command Injection')10 CVEs
CWE-787Out-of-bounds Write7 CVEs
CWE-122Heap-based Buffer Overflow4 CVEs
CWE-22Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')4 CVEs
CWE-89Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')4 CVEs

sources (1)

Which sources assert this record, and when.

RUBDU (FSTEC Data Security Threats Database)89 CVEs

scry

Products carry known vulnerabilities once they are exposed to the internet. See what is exposed on your perimeter with a free passive scan.

Free scan