CVE-2024-38639 - Vulnerability Details - OpenCVE

An improper authentication vulnerability has been reported to affect product. The remote attackers can then exploit the vulnerability to compromise the security of the system. QTS is not affected. We have already fixed the vulnerability in the following version:

No CVSS v4.0

Attack Vector Network

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact Low

Availability Impact Low

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

Vendors	Products
Qnap	Qts

No data.

No data.

References

Link	Providers
https://www.qnap.com/en/security-advisory/qsa-24-37

History

Sat, 19 Sep 2026 14:30:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Fri, 18 Sep 2026 23:45:00 +0000

Type	Values Removed	Values Added
First Time appeared		Qnap Qnap qts
Vendors & Products		Qnap Qnap qts

Fri, 18 Sep 2026 07:00:00 +0000

Type	Values Removed	Values Added
Description		An improper authentication vulnerability has been reported to affect product. The remote attackers can then exploit the vulnerability to compromise the security of the system. QTS is not affected. We have already fixed the vulnerability in the following version:
Title		QTS
Weaknesses		CWE-287
References		https://www.qnap.com/en/security-advisory/qsa-24-37
Metrics		cvssV3_1 `{'score': 4.8, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L'}`

MITRE

Status: PUBLISHED

Assigner: qnap

Published: 2026-09-18T06:51:06.187Z

Updated: 2026-09-18T14:31:44.689Z

Reserved: 2024-06-19T00:17:01.279Z

Link: CVE-2024-38639

Vulnrichment

Updated: 2026-09-18T14:30:07.312Z

NVD

Status : Deferred

Published: 2026-09-18T07:16:49.293

Modified: 2026-09-28T14:10:00.213

Link: CVE-2024-38639

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2024-38639", "assignerOrgId": "2fd009eb-170a-4625-932b-17a53af1051f", "state": "PUBLISHED", "assignerShortName": "qnap", "dateReserved": "2024-06-19T00:17:01.279Z", "datePublished": "2026-09-18T06:51:06.187Z", "dateUpdated": "2026-09-18T14:31:44.689Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "2fd009eb-170a-4625-932b-17a53af1051f", "shortName": "qnap", "dateUpdated": "2026-09-18T06:51:06.187Z"}, "title": "QTS", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-287", "description": "CWE-287", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-115", "descriptions": [{"lang": "en", "value": "CAPEC-115"}]}], "affected": [{"vendor": "QNAP Systems Inc.", "product": "QTS", "versions": [{"status": "unaffected", "version": "?"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "An improper authentication vulnerability has been reported to affect product. The remote attackers can then exploit the vulnerability to compromise the security of the system.\nQTS is not affected.\n\nWe have already fixed the vulnerability in the following version:", "supportingMedia": [{"type": "text/html", "base64": false, "value": "An improper authentication vulnerability has been reported to affect product. The remote attackers can then exploit the vulnerability to compromise the security of the system.<br>QTS is not affected.<br><br>We have already fixed the vulnerability in the following version:<br>"}]}], "references": [{"url": "https://www.qnap.com/en/security-advisory/qsa-24-37"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "HIGH", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "availabilityImpact": "LOW", "baseSeverity": "MEDIUM", "baseScore": 4.8, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L"}}], "solutions": [{"lang": "en", "value": "We have already fixed the vulnerability in the following version:", "supportingMedia": [{"type": "text/html", "base64": false, "value": "We have already fixed the vulnerability in the following version:<br>"}]}], "credits": [{"lang": "en", "value": "Lu\u00eds Almeida Teles", "type": "finder"}], "source": {"advisory": "QSA-24-37", "discovery": "EXTERNAL"}, "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-38639", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-09-18T14:15:06.086803Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-18T14:31:44.689Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-38639", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-09-18T14:15:06.086803Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-18T14:30:07.312Z"}}], "cna": {"title": "QTS", "source": {"advisory": "QSA-24-37", "discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Lu\u00eds Almeida Teles"}], "impacts": [{"capecId": "CAPEC-115", "descriptions": [{"lang": "en", "value": "CAPEC-115"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.8, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "QNAP Systems Inc.", "product": "QTS", "versions": [{"status": "unaffected", "version": "?"}], "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "We have already fixed the vulnerability in the following version:", "supportingMedia": [{"type": "text/html", "value": "We have already fixed the vulnerability in the following version:<br>", "base64": false}]}], "references": [{"url": "https://www.qnap.com/en/security-advisory/qsa-24-37"}], "x_generator": {"engine": "Vulnogram 0.1.0-dev"}, "descriptions": [{"lang": "en", "value": "An improper authentication vulnerability has been reported to affect product. The remote attackers can then exploit the vulnerability to compromise the security of the system.\nQTS is not affected.\n\nWe have already fixed the vulnerability in the following version:", "supportingMedia": [{"type": "text/html", "value": "An improper authentication vulnerability has been reported to affect product. The remote attackers can then exploit the vulnerability to compromise the security of the system.<br>QTS is not affected.<br><br>We have already fixed the vulnerability in the following version:<br>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-287", "description": "CWE-287"}]}], "providerMetadata": {"orgId": "2fd009eb-170a-4625-932b-17a53af1051f", "shortName": "qnap", "dateUpdated": "2026-09-18T06:51:06.187Z"}}}, "cveMetadata": {"cveId": "CVE-2024-38639", "state": "PUBLISHED", "dateUpdated": "2026-09-18T14:31:44.689Z", "dateReserved": "2024-06-19T00:17:01.279Z", "assignerOrgId": "2fd009eb-170a-4625-932b-17a53af1051f", "datePublished": "2026-09-18T06:51:06.187Z", "assignerShortName": "qnap"}, "dataVersion": "5.2"}