Vulnerability · Published Feb 13, 2024 · Assigned by qnap
CVE-2023-47218QTS, QuTS hero, QuTScloud
Medium 5.8
In plain English
A medium-severity command injection in QTS from QNAP Systems Inc.. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 89.9% (higher than 99.8% of all known vulnerabilities). Ready-made attack tooling exists: Metasploit, Nuclei, public proof-of-concept code.
Official description
An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow users to execute commands via a network. We have already fixed the vulnerability in the following versions: QTS 5.1.5.2645 build 20240116 and later QuTS hero h5.1.5.2647 build 20240118 and later QuTScloud c5.1.5.2651 and later
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| QNAP Systems Inc. | QTS | 5.1.x – before 5.1.5.2645 build 20240116 |
| QNAP Systems Inc. | QuTS hero | h5.1.x – before h5.1.5.2647 build 20240118 |
| QNAP Systems Inc. | QuTScloud | c5.x – before c5.1.5.2651 |
Weakness: CWE-77, CWE-78 · Vector: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L