QNAP NAS QTS <5.1.9.2954 build 20241120

productDE

A product tracked in the threat graph; the vulnerabilities below are known to affect it.

KEV-listed

public exploit

EPSS ≥ 10%

by severity

2critical9high2medium0low

updated 2026-10-27

vulnerabilities (16)

Related CVEs.

sort

ID	severity	EPSS	exploitable	patched	published	affected
CVE-2024-50393US	critical9.8	1.31% (70th)	—	no fix	2024-12-06	—
CVE-2024-53692US	—	0.83% (57th)	—	no fix	2025-03-07	—
CVE-2024-48859US	critical9.1	0.58% (48th)	—	no fix	2024-12-06	—
CVE-2024-50402US	high7.2	0.53% (45th)	—	no fix	2024-12-06	—
CVE-2024-53699US	high7.2	0.50% (43rd)	—	no fix	2025-03-07	—
CVE-2024-53697US	high7.2	0.50% (43rd)	—	no fix	2025-03-07	—
CVE-2024-38638US	high7.2	0.50% (43rd)	—	no fix	2025-03-07	—
CVE-2024-53693US	—	0.49% (42nd)	—	no fix	2025-03-07	—
CVE-2024-48867US	high7.5	0.48% (42nd)	—	no fix	2024-12-06	—
CVE-2024-50403US	high7.2	0.48% (41st)	—	no fix	2024-12-06	—
CVE-2024-48868US	high7.5	0.44% (38th)	—	no fix	2024-12-06	—
CVE-2024-48866US	medium5.3	0.42% (36th)	—	no fix	2024-12-06	—
CVE-2024-13086US	high7.5	0.42% (36th)	—	no fix	2025-03-07	—
CVE-2024-50405US	—	0.41% (35th)	—	no fix	2025-03-07	—
CVE-2024-53698US	medium4.9	0.39% (33rd)	—	no fix	2025-03-07	—
CVE-2024-48865US	high7.5	0.15% (5th)	—	no fix	2024-12-06	—

The flaw types (CWEs) most of these CVEs share.

CWE-93Improper Neutralization of CRLF Sequences ('CRLF Injection')4 CVEs
CWE-787Out-of-bounds Write3 CVEs
CWE-134Use of Externally-Controlled Format String2 CVEs
CWE-78Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')2 CVEs
CWE-94Improper Control of Generation of Code ('Code Injection')2 CVEs
CWE-177Improper Handling of URL Encoding (Hex Encoding)1 CVEs
CWE-200Exposure of Sensitive Information to an Unauthorized Actor1 CVEs
CWE-287Improper Authentication1 CVEs

Which sources assert this record, and when.

scry

Products carry known vulnerabilities once they are exposed to the internet. See what is exposed on your perimeter with a free passive scan.