CVE-2023-41282 - QTS, QuTS hero, QuTScloud

Back Back to CVE browser

HIGH

QTS, QuTS hero, QuTScloud

Published Feb 2, 2024

7.2

HIGH

CVSS 3.1

EPSS 0.97%

Description

An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated administrators to execute commands via a network.

We have already fixed the vulnerability in the following versions: QTS 5.1.4.2596 build 20231128 and later QuTS hero h5.1.4.2596 build 20231128 and later QuTScloud c5.1.5.2651 and later

Affected products

Vendor QNAP Systems Inc. Product QTS Default
unaffected
- Version
  5.1.x
  Status
  affected
  Constraints
  <5.1.4.2596 build 20231128
Vendor QNAP Systems Inc. Product QuTS hero Default
unaffected
- Version
  h5.1.x
  Status
  affected
  Constraints
  <h5.1.4.2596 build 20231128
Vendor QNAP Systems Inc. Product QuTScloud Default
unaffected
- Version
  c5.x.x
  Status
  affected
  Constraints
  <c5.1.5.2651

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

QNAP Systems Inc.

QTS

unaffected

Version	Status	Constraints
5.1.x	affected	<5.1.4.2596 build 20231128

QNAP Systems Inc.

QuTS hero

unaffected

Version	Status	Constraints
h5.1.x	affected	<h5.1.4.2596 build 20231128

QNAP Systems Inc.

QuTScloud

unaffected

Version	Status	Constraints
c5.x.x	affected	<c5.1.5.2651

Remediation

Vendor solution

We have already fixed the vulnerability in the following versions: QTS 5.1.4.2596 build 20231128 and later QuTS hero h5.1.4.2596 build 20231128 and later QuTScloud c5.1.5.2651 and later

Weaknesses (2)

CWE-77

CWE-78

OS Command Injection