CVE-2023-41283

An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated administrators to execute commands via a network.

We have already fixed the vulnerability in the following versions:
QTS 5.1.4.2596 build 20231128 and later
QuTS hero h5.1.4.2596 build 20231128 and later
QuTScloud c5.1.5.2651 and later
Command Injection
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
5.5 MEDIUM
NETWORK
LOW
HIGH
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N
qnapCNA
5.5 MEDIUM
NETWORK
LOW
HIGH
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N
CVEADP
---
---
CISA-ADPADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 24%
VendorProductVersion
qnapqts
5.1.0.2348:build_20230325
qnapqts
5.1.0.2399:build_20230515
qnapqts
5.1.0.2418:build_20230603
qnapqts
5.1.0.2444:build_20230629
qnapqts
5.1.0.2466:build_20230721
qnapqts
5.1.1.2491:build_20230815
qnapqts
5.1.2.2533:build_20230926
qnapqts
5.1.3.2578:build_20231110
qnapqts
5.1.4.2596
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://www.qnap.com/en/security-advisory/qsa-23-53
https://www.qnap.com/en/security-advisory/qsa-23-53