CVE-2023-34980

MEDIUM

QNAP QTS 4.5.1-4.5.4.2626 and QuTS hero h4.5.0-h4.5.4.2625 - Authenticated OS Command Injection

Title source: llm
STIX 2.1

Description

An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated administrators to execute commands via a network. We have already fixed the vulnerability in the following versions: QTS 4.5.4.2627 build 20231225 and later QuTS hero h4.5.4.2626 build 20231225 and later

References (1)

Core 1
Core References

Scores

CVSS v3 5.9
EPSS 0.0005
EPSS Percentile 15.1%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact total

Details

CWE
CWE-78
Status published
Products (4)
qnap/qts 4.5.4.2627
qnap/qts 4.5.1 - 4.5.4.2627
qnap/quts_hero h4.5.4.2626
qnap/quts_hero h4.5.0 - h4.5.4.2626
Published Mar 08, 2024
Tracked Since Feb 18, 2026