Quick answers
- Is CVE-2024-27123 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2024-27123 being exploited in the wild.
- How severe is CVE-2024-27123?
- Informational severity, published 18 September 2026.
- Which products and versions are affected?
- QNAP QcalAgent before 1.1.9.
- Is there a fix for CVE-2024-27123?
- A patch was published on 2024: Fixed in QcalAgent 1.1.9 and later Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2024-27123 attacked?
- It is attacked with local access, in a hosted service.
- Am I affected by CVE-2024-27123?
- Check whether you run QNAP QcalAgent at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
A cross-site scripting (XSS) vulnerability exists in QcalAgent that permits local attackers to inject and execute arbitrary client-side scripts. The attack vector requires local access to the affected system. Successful exploitation can lead to bypassing security mechanisms or unauthorized access to application data. The vulnerability has been patched in QcalAgent version 1.1.9 and later.
Affected products
- QNAP QcalAgent before 1.1.9
Timeline
- 2024-09-18: disclosed
- 2024: patched: Fixed in QcalAgent 1.1.9 and later