An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated administrators to execute commands via a network.
We have already fixed the vulnerability in the following versions:
QTS 5.1.3.2578 build 20231110 and later
QuTS hero h5.1.3.2578 build 20231110 and later
References
| Link | Resource |
|---|---|
| https://www.qnap.com/en/security-advisory/qsa-23-54 | Vendor Advisory |
| https://www.qnap.com/en/security-advisory/qsa-23-54 | Vendor Advisory |
Configurations
Configuration 1 (hide)
|
Configuration 2 (hide)
|
History
21 Nov 2024, 08:15
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 6.6 |
| References | () https://www.qnap.com/en/security-advisory/qsa-23-54 - Vendor Advisory |
11 Jan 2024, 17:09
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 7.2 |
| First Time |
Qnap quts Hero
Qnap qts Qnap |
|
| References | () https://www.qnap.com/en/security-advisory/qsa-23-54 - Vendor Advisory | |
| CPE | cpe:2.3:o:qnap:qts:5.1.1.2491:build_20230815:*:*:*:*:*:* cpe:2.3:o:qnap:quts_hero:h5.1.0.2424:build_20230609:*:*:*:*:*:* cpe:2.3:o:qnap:qts:5.1.0.2466:build_20230721:*:*:*:*:*:* cpe:2.3:o:qnap:qts:5.1.2.2533:build_20230926:*:*:*:*:*:* cpe:2.3:o:qnap:quts_hero:h5.1.2.2534:build_20230927:*:*:*:*:*:* cpe:2.3:o:qnap:quts_hero:h5.1.0.2453:build_20230708:*:*:*:*:*:* cpe:2.3:o:qnap:qts:5.1.0.2418:build_20230603:*:*:*:*:*:* cpe:2.3:o:qnap:qts:5.1.0.2444:build_20230629:*:*:*:*:*:* cpe:2.3:o:qnap:quts_hero:h5.1.0.2466:build_20230721:*:*:*:*:*:* cpe:2.3:o:qnap:quts_hero:h5.1.0.2409:build_20230525:*:*:*:*:*:* cpe:2.3:o:qnap:qts:5.1.0.2348:build_20230325:*:*:*:*:*:* cpe:2.3:o:qnap:quts_hero:h5.1.1.2488:build_20230812:*:*:*:*:*:* cpe:2.3:o:qnap:qts:5.1.0.2399:build_20230515:*:*:*:*:*:* |
05 Jan 2024, 18:23
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2024-01-05 17:15
Updated : 2024-11-21 08:15
NVD link : CVE-2023-39294
Mitre link : CVE-2023-39294
CVE.ORG link : CVE-2023-39294
JSON object : View
Products Affected
qnap
- quts_hero
- qts
CWE
CWE-78
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')