QNAP Addresses OS Command Injection Vulnerability
CVE-2023-34979

7.2HIGH

Key Information:

Vendor

QNAP
Status
Qts
Quts Hero
Vendor
CVE Published:
6 September 2024

What is CVE-2023-34979?

An OS command injection vulnerability has been identified in multiple versions of the QNAP operating system, enabling authenticated administrators to execute arbitrary commands through a network interface. This vulnerability poses a significant risk, as it can be exploited to execute potentially harmful commands on affected devices. It is crucial for users to update their systems to the latest versions, specifically QTS 4.5.4.2790 build 20240605 or later, and QuTS hero h4.5.4.2790 build 20240606 or later, to mitigate the risk associated with this vulnerability.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

QTS 4.5.x < 4.5.4.2790 build 20240605

QuTS hero h4.5.x

References

https://www.qnap.com/en/security-advisory/qsa-24-32

CVSS V3.1

Score:
7.2
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Tyaoo、0x14
JSON
.