Command injection in QNAP QuTScloud
Priority MEDIUM 41CWE-77Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-77.
Summary
A command injection vulnerability has been reported to affect QNAP NAS running QuTScloud, QuTS hero and QTS. If exploited, this vulnerability allows remote attackers to run arbitrary commands. We have already fixed this vulnerability in the following versions of QuTScloud, QuTS hero and QTS: QuTScloud c5.0.1.1949 and later QuTS hero h5.0.0.1986 build 20220324 and later QTS 5.0.0.1986 build 20220324 and later
Why it matters now
EPSS 0.01659 76th percentileScored 2026-11-07
Fix Fixed QuTScloud (QNAP Systems Inc.): c5.0.1.1949QuTS hero (QNAP Systems Inc.): h5.0.0.1986 build 20220324+1 more product
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| QNAP | QuTScloud | before c5.0.1.1949 | c5.0.1.1949 | Patch available | CNA |
| QNAP | QuTS hero | before h5.0.0.1986 build 20220324 | h5.0.0.1986 build 20220324 | Patch available | CNA |
| QNAP | QTS | before 5.0.0.1986 build 20220324 | 5.0.0.1986 build 20220324 | Patch available | CNA |
- QuTScloud VendorQNAP Affected before c5.0.1.1949 Fixed in c5.0.1.1949 Patch available CNA
- QuTS hero VendorQNAP Affected before h5.0.0.1986 build 20220324 Fixed in h5.0.0.1986 build 20220324 Patch available CNA
- QTS VendorQNAP Affected before 5.0.0.1986 build 20220324 Fixed in 5.0.0.1986 build 20220324 Patch available CNA
CPE configurations NVD · 15
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:qnap:qts:*:*:*:*:*:*:*:* | 5.0.0.1716 to before 5.0.0.1986 | Vulnerable | QNAP |
| cpe:2.3:o:qnap:qts:*:*:*:*:*:*:*:* | 4.3.3.0174 to before 4.3.3.1945; 4.3.4.0899 to before 4.3.4.1976; 4.3.6.0895 to before 4.3.6.1965; 4.4.0.0883 to before 4.5.4.1991 | Vulnerable | QNAP |
| cpe:2.3:o:qnap:qts:4.2.6:build_20170517:*:*:*:*:*:* | 4.2.6 build_20170517 | Vulnerable | QNAP |
| cpe:2.3:o:qnap:qts:4.2.6:build_20190322:*:*:*:*:*:* | 4.2.6 build_20190322 | Vulnerable | QNAP |
| cpe:2.3:o:qnap:qts:4.2.6:build_20190730:*:*:*:*:*:* | 4.2.6 build_20190730 | Vulnerable | QNAP |
| cpe:2.3:o:qnap:qts:4.2.6:build_20190921:*:*:*:*:*:* | 4.2.6 build_20190921 | Vulnerable | QNAP |
| cpe:2.3:o:qnap:qts:4.2.6:build_20191107:*:*:*:*:*:* | 4.2.6 build_20191107 | Vulnerable | QNAP |
| cpe:2.3:o:qnap:qts:4.2.6:build_20200109:*:*:*:*:*:* | 4.2.6 build_20200109 | Vulnerable | QNAP |
| cpe:2.3:o:qnap:qts:4.2.6:build_20200421:*:*:*:*:*:* | 4.2.6 build_20200421 | Vulnerable | QNAP |
| cpe:2.3:o:qnap:qts:4.2.6:build_20200611:*:*:*:*:*:* | 4.2.6 build_20200611 | Vulnerable | QNAP |
- cpe:2.3:a:qnap:qts:*:*:*:*:*:*:*:* Versions 5.0.0.1716 to before 5.0.0.1986 Vulnerable ·QNAP
- cpe:2.3:o:qnap:qts:*:*:*:*:*:*:*:* Versions 4.3.3.0174 to before 4.3.3.1945; 4.3.4.0899 to before 4.3.4.1976; 4.3.6.0895 to before 4.3.6.1965; 4.4.0.0883 to before 4.5.4.1991 Vulnerable ·QNAP
- cpe:2.3:o:qnap:qts:4.2.6:build_20170517:*:*:*:*:*:* Versions 4.2.6 build_20170517 Vulnerable ·QNAP
- cpe:2.3:o:qnap:qts:4.2.6:build_20190322:*:*:*:*:*:* Versions 4.2.6 build_20190322 Vulnerable ·QNAP
- cpe:2.3:o:qnap:qts:4.2.6:build_20190730:*:*:*:*:*:* Versions 4.2.6 build_20190730 Vulnerable ·QNAP
- cpe:2.3:o:qnap:qts:4.2.6:build_20190921:*:*:*:*:*:* Versions 4.2.6 build_20190921 Vulnerable ·QNAP
- cpe:2.3:o:qnap:qts:4.2.6:build_20191107:*:*:*:*:*:* Versions 4.2.6 build_20191107 Vulnerable ·QNAP
- cpe:2.3:o:qnap:qts:4.2.6:build_20200109:*:*:*:*:*:* Versions 4.2.6 build_20200109 Vulnerable ·QNAP
- cpe:2.3:o:qnap:qts:4.2.6:build_20200421:*:*:*:*:*:* Versions 4.2.6 build_20200421 Vulnerable ·QNAP
- cpe:2.3:o:qnap:qts:4.2.6:build_20200611:*:*:*:*:*:* Versions 4.2.6 build_20200611 Vulnerable ·QNAP
Show 5 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:qnap:qts:4.2.6:build_20200821:*:*:*:*:*:* | 4.2.6 build_20200821 | Vulnerable | QNAP |
| cpe:2.3:o:qnap:qts:4.2.6:build_20210327:*:*:*:*:*:* | 4.2.6 build_20210327 | Vulnerable | QNAP |
| cpe:2.3:o:qnap:qts:4.2.6:build_20211215:*:*:*:*:*:* | 4.2.6 build_20211215 | Vulnerable | QNAP |
| cpe:2.3:o:qnap:quts_hero:*:*:*:*:*:*:*:* | before h4.5.4.1771; h5.0.0.1772 to before h5.0.0.1986 | Vulnerable | QNAP |
| cpe:2.3:o:qnap:qutscloud:*:*:*:*:*:*:*:* | before c5.0.1.1998 | Vulnerable | QNAP |
- cpe:2.3:o:qnap:qts:4.2.6:build_20200821:*:*:*:*:*:* Versions 4.2.6 build_20200821 Vulnerable ·QNAP
- cpe:2.3:o:qnap:qts:4.2.6:build_20210327:*:*:*:*:*:* Versions 4.2.6 build_20210327 Vulnerable ·QNAP
- cpe:2.3:o:qnap:qts:4.2.6:build_20211215:*:*:*:*:*:* Versions 4.2.6 build_20211215 Vulnerable ·QNAP
- cpe:2.3:o:qnap:quts_hero:*:*:*:*:*:*:*:* Versions before h4.5.4.1771; h5.0.0.1772 to before h5.0.0.1986 Vulnerable ·QNAP
- cpe:2.3:o:qnap:qutscloud:*:*:*:*:*:*:*:* Versions before c5.0.1.1998 Vulnerable ·QNAP
Remediation
- Fix · CNA QuTScloud (QNAP Systems Inc.) Fixed in c5.0.1.1949
- Fix · CNA QuTS hero (QNAP Systems Inc.) Fixed in h5.0.0.1986 build 20220324
- Fix · CNA QTS (QNAP Systems Inc.) Fixed in 5.0.0.1986 build 20220324
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
QNAP Systems QuTScloud c5.0.1.1949
4 records Highest priority Priority MEDIUM 1 MEDIUM, 3 LOW
Other records, highest priority first
- TI-2021-19802 Reflected XSS in QNAP QTSPriority LOW 29
- TI-2021-19803 Open redirect in QNAP QuTScloudPriority LOW 28
- TI-2021-16264 Path Traversal in thttpdPriority LOW 26
Timeline
- 2026-10-02 Threatist record created from CVE-2021-44051
- 2026-10-03 Alias added: GHSA-hp68-q6cw-rc79
References
More QNAP Qts vulnerabilities
- TI-2020-02221 Command Injection Vulnerability in QTS and QuTS hero KEVCVSS 3.1CRITICAL 9.8
- TI-2019-05101 Improper input validation in QNAP NAS devices KEVCVSS 3.1CRITICAL 9.8
- TI-2018-14137 Improper input validation in QNAP QTS KEVCVSS 3.1CRITICAL 9.8
- TI-2014-05975 GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed… KEVCVSS 3.1CRITICAL 9.8
- TI-2014-05157 GNU Bash through 4.3 processes trailing strings after function definitions in the values… KEVCVSS 3.1CRITICAL 9.8
- TI-2018-14131 Cross-site scripting in QNAP QTS KEVCVSS 3.1HIGH 8.0
Sources
- CVE-2021-44051 · CVE Program
- CVE-2021-44051 · NVD
- FIRST EPSS
- GHSA-hp68-q6cw-rc79 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences