QTS Vulnerability Could Allow Command Injection Via Network
CVE-2023-39300

7.2HIGH

Key Information:

Vendor
QNAP
Status
Qts
Quts Hero
Qutscloud
Vendor
CVE Published:
6 September 2024

Summary

An OS command injection vulnerability has been identified in legacy QTS, allowing authenticated administrators to execute arbitrary commands over the network. This weakness poses a significant risk as it enables unauthorized access to system commands, which could lead to potentially harmful modifications or data breaches. Immediate action is advised to upgrade to patched versions of QTS, with detailed update information available through the security advisory.

Affected Version(s)

QTS 4.3.6 < 4.3.6.2805 build 20240619

QTS 4.3.4 < 4.3.4.2814 build 20240618

QTS 4.3.3 < 4.3.3.2784 build 20240619

References

https://www.qnap.com/en/security-advisory/qsa-24-26

CVSS V3.1

Score:
7.2
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Arseniy Sharoglazov
.