QNAP QTS: CVE-2024-38641: Multiple Vulnerabilities in QTS and QuTS hero

Multiple vulnerabilities have been reported to affect certain QNAP operating system versions: CVE-2024-32763: If exploited, the buffer copy without checking size of input vulnerability could allow remote attackers who have gained user access to execute arbitrary code. CVE-2024-38641: If exploited, the OS command injection vulnerability could allow local attackers who have gained user access to inject malicious commands. CVE-2024-21906: If exploited, the OS command injection vulnerability could allow remote attackers who have gained administrator access to inject malicious commands. We have already fixed the vulnerabilities in the following versions: