QNAP Systems Inc. QuTS hero

Name: QNAP Systems Inc. QuTS hero
Brand: QNAP Systems Inc.

productEU

A product tracked in the threat graph; the vulnerabilities below are known to affect it.

by severity

14critical105high99medium3low

updated 2026-10-28

vulnerabilities (228)

Related CVEs.

sort

ID	severity	EPSS	exploitable	patched	published	affected
CVE-2020-2509US	critical9.8OT critical	34.0% (98th)	KEV	h4.5.1.1491 build 20201119	2021-04-17	unspecified → h4.5.1.1491 build 20201119
CVE-2023-47218US	high8.3	89.9% (100th)	Exploit	h5.1.5.2647 build 20240118	2024-02-13	2 versions
CVE-2024-27130US	high8.8	37.5% (99th)	Exploit	h5.1.7.2770 build 20240520	2024-05-21	h5.1.x → h5.1.7.2770 build 20240520
CVE-2024-53691US	high8.8	23.8% (98th)	Exploit	h5.1.8.2823 build 20240712	2024-12-06	2 versions
CVE-2023-51364US	high7.5	39.7% (99th)	—	h4.5.4.2626 build 20231225	2024-04-26	3 versions
CVE-2023-51365US	high7.5	34.8% (98th)	—	h5.1.3.2578 build 20231110	2024-04-26	3 versions
CVE-2024-21899US	critical9.8	24.4% (98th)	—	h5.1.3.2578 build 20231110	2024-03-08	3 versions
CVE-2023-23368US	critical9.8	18.7% (97th)	—	h5.0.1.2376 build 20230421	2023-11-03	2 versions
CVE-2023-50358US	—	13.5% (96th)	—	h4.5.4.2626 build 20231225	2024-02-13	2 versions
CVE-2024-21900US	medium6.5	9.41% (95th)	—	h5.1.3.2578 build 20231110	2024-03-08	h5.1.x → h5.1.3.2578 build 20231110
CVE-2019-7198US	critical9.8	2.72% (86th)	—	no fix	2020-12-10	≤ < h4.5.1.1472
CVE-2022-27596US	critical9.8	2.66% (86th)	—	h5.0.1.2248 build 20221215	2023-01-30	h5.0.1 → h5.0.1.2248 build 20221215
CVE-2020-25847US	high8.8	2.58% (85th)	—	h4.5.1.1491	2020-12-29	unspecified → h4.5.1.1491
CVE-2024-32766US	—	2.31% (83rd)	—	h5.1.3.2578 build 20231110	2024-04-26	3 versions
CVE-2021-34343US	high7.2	1.95% (80th)	—	h4.5.4.1771 build 20210825	2021-09-10	unspecified → h4.5.4.1771 build 20210825
CVE-2020-2508US	high7.2	1.85% (79th)	—	no fix	2021-01-11	≤ < h4.5.1.1472
CVE-2021-28804US	critical9.8	1.82% (79th)	—	h4.5.1.1582 build 20210217	2021-07-01	unspecified → h4.5.1.1582 build 20210217
CVE-2021-28802US	critical9.8	1.82% (79th)	—	h4.5.1.1582 build 20210217	2021-07-01	unspecified → h4.5.1.1582 build 20210217
CVE-2025-30264US	high8.8	1.67% (77th)	—	h5.2.5.3138 build 20250519	2025-08-29	h5.2.x → h5.2.5.3138 build 20250519
CVE-2021-44051US	high8.8	1.66% (77th)	—	h5.0.0.1986 build 20220324	2022-05-05	unspecified → h5.0.0.1986 build 20220324
CVE-2023-23362US	high8.8	1.60% (76th)	—	h5.0.1.2376 build 20230421	2023-09-22	2 versions
CVE-2021-44052US	high8.1	1.59% (76th)	—	h5.0.0.1986 build 20220324	2022-05-05	2 versions
CVE-2023-39296US	high7.5	1.56% (75th)	—	h5.1.3.2578 build 20231110	2024-01-05	h5.1.x → h5.1.3.2578 build 20231110
CVE-2023-23367US	high7.2	1.50% (74th)	—	h5.0.1.2376 build 20230421	2023-11-10	h5.0.x → h5.0.1.2376 build 20230421
CVE-2024-27124US	—	1.44% (73rd)	—	h5.1.3.2578 build 20231110	2024-04-26	3 versions
CVE-2023-39297US	high8.8	1.41% (72nd)	—	h4.5.4.2626 build 20231225	2024-02-02	2 versions
CVE-2025-47212US	high7.2	1.33% (71st)	—	h5.2.6.3195 build 20250715	2025-10-03	h5.2.x → h5.2.6.3195 build 20250715
CVE-2024-50393US	critical9.8	1.31% (70th)	—	h5.2.2.2952 build 20241116	2024-12-06	2 versions
CVE-2023-23355US	high7.2	1.23% (69th)	—	h4.5.4.2374 build 20230417	2023-03-29	2 versions
CVE-2023-34975US	high8.8	1.22% (69th)	—	h4.5.4.2626 build 20231225	2023-10-13	h4.5.x → h4.5.4.2626 build 20231225
CVE-2024-21898US	high8.8	1.21% (68th)	—	h5.1.6.2734 build 20240414	2024-09-06	h5.1.x → h5.1.6.2734 build 20240414
CVE-2023-47566US	high7.2	1.18% (67th)	—	h5.1.5.2647 build 20240118	2024-02-02	h5.1.x → h5.1.5.2647 build 20240118
CVE-2023-45025US	critical9.8	1.13% (66th)	—	h5.1.4.2596 build 20231128	2024-02-02	2 versions
CVE-2023-39294US	high7.2	1.12% (66th)	—	h5.1.3.2578 build 20231110	2024-01-05	h5.1.x → h5.1.3.2578 build 20231110
CVE-2023-47567US	high7.2	1.11% (66th)	—	h4.5.4.2626 build 20231225	2024-02-02	2 versions
CVE-2026-22893US	high7.2	1.09% (65th)	—	h6.0.0.3459 build 20260409	2026-06-10	3 versions
CVE-2023-34979US	high7.2	1.07% (65th)	—	h4.5.4.2790 build 20240606	2024-09-06	h4.5.x → h4.5.4.2790 build 20240606
CVE-2023-39302US	high7.2	1.07% (65th)	—	h5.1.3.2578 build 20231110	2024-02-02	h5.1.x → h5.1.3.2578 build 20231110
CVE-2025-66279US	high7.2	1.05% (64th)	—	h6.0.0.3397 build 20260206	2026-06-10	3 versions
CVE-2025-66273US	high7.2	1.05% (64th)	—	h5.3.4.3500 build 20260520	2026-06-10	3 versions
CVE-2020-2495US	medium6.1	1.04% (64th)	—	no fix	2020-12-10	≤ < h4.5.1.1472
CVE-2020-2496US	medium6.1	1.02% (63rd)	—	no fix	2020-12-10	≤ < h4.5.1.1472
CVE-2023-34974US	high8.8	0.99% (62nd)	—	h4.5.4.2626 build 20231225	2024-09-06	h4.5.x → h4.5.4.2626 build 20231225
CVE-2020-2497US	medium6.1	0.98% (62nd)	—	no fix	2020-12-10	≤ < h4.5.1.1472
CVE-2026-24719US	high7.2	0.98% (62nd)	—	h5.2.9.3499 build 20260514	2026-06-10	h5.2.0 → h5.2.9.3499 build 20260514
CVE-2025-22481US	high8.8	0.97% (62nd)	—	h5.2.4.3079 build 20250321	2025-06-06	h5.2.x → h5.2.4.3079 build 20250321
CVE-2023-41283US	high7.2	0.97% (62nd)	—	h5.1.4.2596 build 20231128	2024-02-02	h5.1.x → h5.1.4.2596 build 20231128
CVE-2023-41282US	high7.2	0.97% (62nd)	—	h5.1.4.2596 build 20231128	2024-02-02	h5.1.x → h5.1.4.2596 build 20231128
CVE-2023-41281US	high7.2	0.97% (62nd)	—	h5.1.4.2596 build 20231128	2024-02-02	h5.1.x → h5.1.4.2596 build 20231128
CVE-2025-62849US	critical9.8	0.97% (62nd)	—	h5.3.1.3292 build 20251024	2025-12-16	2 versions

showing 50 of 228

weaknesses (8)

The flaw types (CWEs) most of these CVEs share.

CWE-476NULL Pointer Dereference45 CVEs
CWE-78Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')41 CVEs
CWE-120Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')40 CVEs
CWE-121Stack-based Buffer Overflow23 CVEs
CWE-22Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')17 CVEs
CWE-77Improper Neutralization of Special Elements used in a Command ('Command Injection')17 CVEs
CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')14 CVEs
CWE-134Use of Externally-Controlled Format String13 CVEs

sources (1)

Which sources assert this record, and when.

EUEU Vulnerability Database (ENISA)228 CVEs

scry

Products carry known vulnerabilities once they are exposed to the internet. See what is exposed on your perimeter with a free passive scan.

Free scan