CVE-2023-34979

MEDIUM

QNAP QTS and QuTS hero - Authenticated OS Command Injection

Title source: llm
STIX 2.1

Description

An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated administrators to execute commands via a network. We have already fixed the vulnerability in the following versions: QTS 4.5.4.2790 build 20240605 and later QuTS hero h4.5.4.2790 build 20240606 and later

References (1)

Core 1
Core References

Scores

CVSS v3 6.6
EPSS 0.0009
EPSS Percentile 25.9%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-78
Status published
Products (28)
qnap/qts 4.5.4.1715 build_20210630
qnap/qts 4.5.4.1723 build_20210708
qnap/qts 4.5.4.1741 build_20210726
qnap/qts 4.5.4.1787 build_20210910
qnap/qts 4.5.4.1800 build_20210923
qnap/qts 4.5.4.1892 build_20211223
qnap/qts 4.5.4.1931 build_20220128
qnap/qts 4.5.4.2012 build_20220419
qnap/qts 4.5.4.2117 build_20220802
qnap/qts 4.5.4.2280 build_20230112
... and 18 more
Published Sep 06, 2024
Tracked Since Feb 18, 2026