Administrator-authenticated code execution via unchecked buffer copy

Buffer overflow in QNAP QTS 5.1.x and QuTS hero h5.1.x allows remote authenticated users with administrator access to execute code. An undisclosed network-facing component copies attacker-controlled input into a destination buffer without verifying that it fits; QNAP has not named the component or copy operation. Successful exploitation executes code in the appliance context; no unauthenticated path is reported.