CVE-2024-53696

mediumpriority · track · 20EPSS 0.004 · 39 %ileDEEUUS

grimoire priorityP3 · Track

Exploitable?

—

no known exploitation

Likely / severe?

0.45% (39th) EPSS

CVSS 4.9 · medium

Is it mine?

16 products

Check your exposure

Who says so?

4 sources

cnnvd · enisa_euvd · cert_bund · nvd

EPSS · scored 2026-10-27

A server-side request forgery (SSRF) vulnerability has been reported to affect QuLog Center. If exploited, the vulnerability could allow remote attackers who have gained administrator access to read application data. We have already fixed the vulnerability in the following versions: QuLog Center 1.7.0.829 ( 2024/10/01 ) and later QuLog Center 1.8.0.888 ( 2024/10/15 ) and later QTS 4.5.4.2957 build 20241119 and later QuTS hero h4.5.4.2956 build 20241119 and later

cvss

Technical severity, 0–10. One row per scoring source.

5.1

010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · low–medium · 1.2–5.1

v3.14.9mediumCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:Nprimary · NVD / NIST USexploitability 1.2 · impact 3.6

v4.05.1mediumCVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:Nsecondary · ENISA EU

v4.05.1mediumCVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Xsecondary · security@qnapsecurity.com.tw

v4.01.2lowCVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Xsecondary · CVSS-BT (t0sche)

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Trackcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-918US

affected products (16)

Products and version ranges known to be affected.

QNAP NAS QTS <4.5.4.2957 build 20241119all versionscert_bundDE
QNAP NAS QuLog Center <1.7.0.829 (2024/10/01)all versionscert_bundDE
QNAP NAS QuLog Center <1.8.0.888 (2024/10/15)all versionscert_bundDE
QNAP NAS QuTS hero <h4.5.4.2956 build 20241119all versionscert_bundDE
QNAP NAS≤ QuTS hero <h4.5.4.2956 build 20241119cert_bundDE
QNAP NAS≤ QTS <4.5.4.2957 build 20241119cert_bundDE
QNAP NAS≤ QuLog Center <1.7.0.829 (2024/10/01)cert_bundDE
QNAP NAS≤ QuLog Center <1.8.0.888 (2024/10/15)cert_bundDE
QNAP Systems Inc. QTS4.5.x → 4.5.4.2957 build 20241119enisa_euvdEU
QNAP Systems Inc. QuLog Center1.7.x.x → 1.7.0.829 ( 2024/10/01 )enisa_euvdEU
QNAP Systems Inc. QuLog Center1.8.x.x → 1.8.0.888 ( 2024/10/15 )enisa_euvdEU
QNAP Systems Inc. QuTS heroh4.5.x → h4.5.4.2956 build 20241119enisa_euvdEU
qnap qts4.5.1 → 4.5.4.2957nvdUScpe:2.3:o:qnap:qts:*:*:*:*:*:*:*:*
qnap qulog center1.7.0 → 1.7.0.829nvdUScpe:2.3:a:qnap:qulog_center:*:*:*:*:*:*:*:*
qnap qulog center1.8.0 → 1.8.0.888nvdUScpe:2.3:a:qnap:qulog_center:*:*:*:*:*:*:*:*
qnap quts heroh4.5.0 → h4.5.4.2476nvdUScpe:2.3:o:qnap:quts_hero:*:*:*:*:*:*:*:*

advisories (1)

Vendor and ecosystem advisories describing this.

WID-SEC-W-2025-0506QNAP NAS (QuLog Center, QTS, QuTS hero): Mehrere SchwachstellenDeutsch2025-03-09csaf · cert_bundDE
Ein entfernter anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in QNAP NAS ausnutzen, um Informationen preiszugeben, Daten zu verändern, beliebigen Code auszuführen und möglicherweise einen Denial-of-Service-Zustand zu verursachen.

also known as (3)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd cert_bund nvd NVD CVE.org MITRE

published 2025-03-07modified 2026-06-17

references (5)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan