An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated administrators to execute commands via a network.
We have already fixed the vulnerability in the following versions:
QTS 5.0.1.2376 build 20230421 and later
QuTS hero h5.0.1.2376 build 20230421 and later
QuTScloud c5.1.0.2498 and later
References
| Link | Resource |
|---|---|
| https://www.qnap.com/en/security-advisory/qsa-23-24 | Vendor Advisory |
Configurations
Configuration 1 (hide)
|
Configuration 2 (hide)
|
Configuration 3 (hide)
|
History
21 Nov 2023, 03:08
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:o:qnap:qts:5.0.0.1870:build_20211201:*:*:*:*:*:* cpe:2.3:o:qnap:quts_hero:h5.0.1.2045:build_20220526:*:*:*:*:*:* cpe:2.3:o:qnap:qts:5.0.0.1828:build_20211020:*:*:*:*:*:* cpe:2.3:o:qnap:quts_hero:h5.0.0.2120:build_20220804:*:*:*:*:*:* cpe:2.3:o:qnap:quts_hero:h5.0.0.2069:build_20220614:*:*:*:*:*:* cpe:2.3:o:qnap:quts_hero:h5.0.1.2277:build_20230112:*:*:*:*:*:* cpe:2.3:o:qnap:qts:5.0.1.2145:build_20220903:*:*:*:*:*:* cpe:2.3:o:qnap:qutscloud:c5.0.1.1998:build_20220408:*:*:*:*:*:* cpe:2.3:o:qnap:qts:5.0.1.2034:build_20220515:*:*:*:*:*:* cpe:2.3:o:qnap:qts:5.0.0.1837:build_20211029:*:*:*:*:*:* cpe:2.3:o:qnap:quts_hero:h5.0.1.2269:build_20230104:*:*:*:*:*:* cpe:2.3:o:qnap:quts_hero:h5.0.1.2348:build_20230324:*:*:*:*:*:* cpe:2.3:o:qnap:quts_hero:h5.0.1.2192:build_20221020:*:*:*:*:*:* cpe:2.3:o:qnap:qts:5.0.1.2137:build_20220826:*:*:*:*:*:* cpe:2.3:o:qnap:quts_hero:h5.0.0.2022:build_20220428:*:*:*:*:*:* cpe:2.3:o:qnap:qts:5.0.1.2234:build_20221201:*:*:*:*:*:* cpe:2.3:o:qnap:qutscloud:c5.0.1.2044:build_20220524:*:*:*:*:*:* cpe:2.3:o:qnap:qts:5.0.1.2277:build_20230112:*:*:*:*:*:* cpe:2.3:o:qnap:qts:5.0.1.2346:build_20230322:*:*:*:*:*:* cpe:2.3:o:qnap:qutscloud:c5.0.1.1949:build_20220218:*:*:*:*:*:* cpe:2.3:o:qnap:quts_hero:h5.0.0.1986:build_20220324:*:*:*:*:*:* cpe:2.3:o:qnap:qts:5.0.0.1858:build_20211119:*:*:*:*:*:* cpe:2.3:o:qnap:qts:5.0.0.1853:build_20211114:*:*:*:*:*:* cpe:2.3:o:qnap:qts:5.0.0.1808:build_20211001:*:*:*:*:*:* cpe:2.3:o:qnap:qts:5.0.1.2248:build_20221215:*:*:*:*:*:* cpe:2.3:o:qnap:quts_hero:h5.0.1.2248:build_20221215:*:*:*:*:*:* cpe:2.3:o:qnap:qts:5.0.0.1785:build_20210908:*:*:*:*:*:* cpe:2.3:o:qnap:qts:5.0.1.2194:build_20221022:*:*:*:*:*:* cpe:2.3:o:qnap:quts_hero:h5.0.0.1856:build_20211117:*:*:*:*:*:* cpe:2.3:o:qnap:quts_hero:h5.0.0.1844:build_20211105:*:*:*:*:*:* cpe:2.3:o:qnap:quts_hero:h5.0.0.1892:build_20211222:*:*:*:*:*:* cpe:2.3:o:qnap:qts:5.0.1.2173:build_20221001:*:*:*:*:*:* cpe:2.3:o:qnap:qutscloud:c5.0.1.2374:build_20230419:*:*:*:*:*:* cpe:2.3:o:qnap:qts:5.0.0.1716:build_20210701:*:*:*:*:*:* cpe:2.3:o:qnap:quts_hero:h5.0.0.1900:build_20211228:*:*:*:*:*:* cpe:2.3:o:qnap:qutscloud:c5.0.0.1919:build_20220119:*:*:*:*:*:* cpe:2.3:o:qnap:quts_hero:h5.0.0.1772:build_20210826:*:*:*:*:*:* cpe:2.3:o:qnap:quts_hero:h5.0.0.1949:build_20220215:*:*:*:*:*:* cpe:2.3:o:qnap:qts:5.0.0.1850:build_20211111:*:*:*:*:*:* cpe:2.3:o:qnap:qts:5.0.1.2131:build_20220820:*:*:*:*:*:* cpe:2.3:o:qnap:qts:5.0.1.2079:build_20220629:*:*:*:*:*:* cpe:2.3:o:qnap:qutscloud:c5.0.1.2148:build_20220905:*:*:*:*:*:* |
|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 7.2 |
| References | () https://www.qnap.com/en/security-advisory/qsa-23-24 - Vendor Advisory | |
| First Time |
Qnap
Qnap qts Qnap qutscloud Qnap quts Hero |
10 Nov 2023, 15:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2023-11-10 15:15
Updated : 2023-12-10 15:26
NVD link : CVE-2023-23367
Mitre link : CVE-2023-23367
CVE.ORG link : CVE-2023-23367
JSON object : View
Products Affected
qnap
- quts_hero
- qutscloud
- qts
CWE
CWE-78
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')