CVE-2020-25847

HIGH

QNAP QTS < 4.5.1.1495 and QuTS hero < h4.5.1.1491 - OS Command Injection

Title source: llm

Description

This command injection vulnerability allows attackers to execute arbitrary commands in a compromised application. QNAP have already fixed this vulnerability in the following versions of QTS and QuTS hero.

References (1)

Core 1

Core References

Vendor Advisory x_refsource_misc

https://www.qnap.com/en/security-advisory/qsa-20-20

Scores

CVSS v3 8.8

EPSS 0.0150

EPSS Percentile 81.4%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Details

CWE

CWE-78 CWE-77

Status published

Products (2)

qnap/qts < 4.5.1.1495

qnap/quts_hero < h4.5.1.1491

Published Dec 29, 2020

Tracked Since Feb 18, 2026