Description
This command injection vulnerability allows attackers to execute arbitrary commands in a compromised application. QNAP have already fixed this vulnerability in the following versions of QTS and QuTS hero. QuTS hero h4.5.1.1472 build 20201031 and later QTS 4.5.1.1456 build 20201015 and later QTS 4.4.3.1354 build 20200702 and later
References (1)
Core 1
Core References
Vendor Advisory x_refsource_confirm
https://www.qnap.com/en/security-advisory/qsa-20-16
Scores
CVSS v3
9.8
EPSS
0.0307
EPSS Percentile
86.9%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Details
CWE
CWE-78
CWE-77
Status
published
Products (2)
qnap/qts
< 4.4.3.1354
qnap/quts_hero
< h4.5.1.1472
Published
Dec 10, 2020
Tracked Since
Feb 18, 2026