Read the docs
TI-2023-09213 Aliases CVE-2023-23367GHSA-p49w-7qqv-rf9v

OS command injection in QNAP QTS

Priority LOW 37CWE-78Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-78.

Summary

An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated administrators to execute commands via a network. We have already fixed the vulnerability in the following versions: QTS 5.0.1.2376 build 20230421 and later QuTS hero h5.0.1.2376 build 20230421 and later QuTScloud c5.1.0.2498 and later

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01496 74th percentileScored 2026-11-07
Fix Fixed QTS (QNAP Systems Inc.): 5.0.1.2376 build 20230421QuTS hero (QNAP Systems Inc.): h5.0.1.2376 build 20230421+1 more product

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
QNAPQTS5.0.x to before 5.0.1.2376 build 202304215.0.1.2376 build 20230421Patch availableCNA
QNAPQuTS heroh5.0.x to before h5.0.1.2376 build 20230421h5.0.1.2376 build 20230421Patch availableCNA
QNAPQuTScloudc5.x.x to before c5.1.0.2498c5.1.0.2498Patch availableCNA
  • QTS VendorQNAP Affected 5.0.x to before 5.0.1.2376 build 20230421 Fixed in 5.0.1.2376 build 20230421 Patch available CNA
  • QuTS hero VendorQNAP Affected h5.0.x to before h5.0.1.2376 build 20230421 Fixed in h5.0.1.2376 build 20230421 Patch available CNA
  • QuTScloud VendorQNAP Affected c5.x.x to before c5.1.0.2498 Fixed in c5.1.0.2498 Patch available CNA

CPE configurations NVD · 42

CPEVersionsRoleVendor
cpe:2.3:o:qnap:qts:5.0.0.1716:build_20210701:*:*:*:*:*:*5.0.0.1716 build_20210701VulnerableQNAP
cpe:2.3:o:qnap:qts:5.0.0.1785:build_20210908:*:*:*:*:*:*5.0.0.1785 build_20210908VulnerableQNAP
cpe:2.3:o:qnap:qts:5.0.0.1808:build_20211001:*:*:*:*:*:*5.0.0.1808 build_20211001VulnerableQNAP
cpe:2.3:o:qnap:qts:5.0.0.1828:build_20211020:*:*:*:*:*:*5.0.0.1828 build_20211020VulnerableQNAP
cpe:2.3:o:qnap:qts:5.0.0.1837:build_20211029:*:*:*:*:*:*5.0.0.1837 build_20211029VulnerableQNAP
cpe:2.3:o:qnap:qts:5.0.0.1850:build_20211111:*:*:*:*:*:*5.0.0.1850 build_20211111VulnerableQNAP
cpe:2.3:o:qnap:qts:5.0.0.1853:build_20211114:*:*:*:*:*:*5.0.0.1853 build_20211114VulnerableQNAP
cpe:2.3:o:qnap:qts:5.0.0.1858:build_20211119:*:*:*:*:*:*5.0.0.1858 build_20211119VulnerableQNAP
cpe:2.3:o:qnap:qts:5.0.0.1870:build_20211201:*:*:*:*:*:*5.0.0.1870 build_20211201VulnerableQNAP
cpe:2.3:o:qnap:qts:5.0.1.2034:build_20220515:*:*:*:*:*:*5.0.1.2034 build_20220515VulnerableQNAP
  • cpe:2.3:o:qnap:qts:5.0.0.1716:build_20210701:*:*:*:*:*:* Versions 5.0.0.1716 build_20210701 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:5.0.0.1785:build_20210908:*:*:*:*:*:* Versions 5.0.0.1785 build_20210908 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:5.0.0.1808:build_20211001:*:*:*:*:*:* Versions 5.0.0.1808 build_20211001 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:5.0.0.1828:build_20211020:*:*:*:*:*:* Versions 5.0.0.1828 build_20211020 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:5.0.0.1837:build_20211029:*:*:*:*:*:* Versions 5.0.0.1837 build_20211029 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:5.0.0.1850:build_20211111:*:*:*:*:*:* Versions 5.0.0.1850 build_20211111 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:5.0.0.1853:build_20211114:*:*:*:*:*:* Versions 5.0.0.1853 build_20211114 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:5.0.0.1858:build_20211119:*:*:*:*:*:* Versions 5.0.0.1858 build_20211119 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:5.0.0.1870:build_20211201:*:*:*:*:*:* Versions 5.0.0.1870 build_20211201 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:5.0.1.2034:build_20220515:*:*:*:*:*:* Versions 5.0.1.2034 build_20220515 Vulnerable ·QNAP
Show 32 more CPE
CPEVersionsRoleVendor
cpe:2.3:o:qnap:qts:5.0.1.2079:build_20220629:*:*:*:*:*:*5.0.1.2079 build_20220629VulnerableQNAP
cpe:2.3:o:qnap:qts:5.0.1.2131:build_20220820:*:*:*:*:*:*5.0.1.2131 build_20220820VulnerableQNAP
cpe:2.3:o:qnap:qts:5.0.1.2137:build_20220826:*:*:*:*:*:*5.0.1.2137 build_20220826VulnerableQNAP
cpe:2.3:o:qnap:qts:5.0.1.2145:build_20220903:*:*:*:*:*:*5.0.1.2145 build_20220903VulnerableQNAP
cpe:2.3:o:qnap:qts:5.0.1.2173:build_20221001:*:*:*:*:*:*5.0.1.2173 build_20221001VulnerableQNAP
cpe:2.3:o:qnap:qts:5.0.1.2194:build_20221022:*:*:*:*:*:*5.0.1.2194 build_20221022VulnerableQNAP
cpe:2.3:o:qnap:qts:5.0.1.2234:build_20221201:*:*:*:*:*:*5.0.1.2234 build_20221201VulnerableQNAP
cpe:2.3:o:qnap:qts:5.0.1.2248:build_20221215:*:*:*:*:*:*5.0.1.2248 build_20221215VulnerableQNAP
cpe:2.3:o:qnap:qts:5.0.1.2277:build_20230112:*:*:*:*:*:*5.0.1.2277 build_20230112VulnerableQNAP
cpe:2.3:o:qnap:qts:5.0.1.2346:build_20230322:*:*:*:*:*:*5.0.1.2346 build_20230322VulnerableQNAP
cpe:2.3:o:qnap:quts_hero:h5.0.0.1772:build_20210826:*:*:*:*:*:*h5.0.0.1772 build_20210826VulnerableQNAP
cpe:2.3:o:qnap:quts_hero:h5.0.0.1844:build_20211105:*:*:*:*:*:*h5.0.0.1844 build_20211105VulnerableQNAP
cpe:2.3:o:qnap:quts_hero:h5.0.0.1856:build_20211117:*:*:*:*:*:*h5.0.0.1856 build_20211117VulnerableQNAP
cpe:2.3:o:qnap:quts_hero:h5.0.0.1892:build_20211222:*:*:*:*:*:*h5.0.0.1892 build_20211222VulnerableQNAP
cpe:2.3:o:qnap:quts_hero:h5.0.0.1900:build_20211228:*:*:*:*:*:*h5.0.0.1900 build_20211228VulnerableQNAP
cpe:2.3:o:qnap:quts_hero:h5.0.0.1949:build_20220215:*:*:*:*:*:*h5.0.0.1949 build_20220215VulnerableQNAP
cpe:2.3:o:qnap:quts_hero:h5.0.0.1986:build_20220324:*:*:*:*:*:*h5.0.0.1986 build_20220324VulnerableQNAP
cpe:2.3:o:qnap:quts_hero:h5.0.0.2022:build_20220428:*:*:*:*:*:*h5.0.0.2022 build_20220428VulnerableQNAP
cpe:2.3:o:qnap:quts_hero:h5.0.0.2069:build_20220614:*:*:*:*:*:*h5.0.0.2069 build_20220614VulnerableQNAP
cpe:2.3:o:qnap:quts_hero:h5.0.0.2120:build_20220804:*:*:*:*:*:*h5.0.0.2120 build_20220804VulnerableQNAP
cpe:2.3:o:qnap:quts_hero:h5.0.1.2045:build_20220526:*:*:*:*:*:*h5.0.1.2045 build_20220526VulnerableQNAP
cpe:2.3:o:qnap:quts_hero:h5.0.1.2192:build_20221020:*:*:*:*:*:*h5.0.1.2192 build_20221020VulnerableQNAP
cpe:2.3:o:qnap:quts_hero:h5.0.1.2248:build_20221215:*:*:*:*:*:*h5.0.1.2248 build_20221215VulnerableQNAP
cpe:2.3:o:qnap:quts_hero:h5.0.1.2269:build_20230104:*:*:*:*:*:*h5.0.1.2269 build_20230104VulnerableQNAP
cpe:2.3:o:qnap:quts_hero:h5.0.1.2277:build_20230112:*:*:*:*:*:*h5.0.1.2277 build_20230112VulnerableQNAP
cpe:2.3:o:qnap:quts_hero:h5.0.1.2348:build_20230324:*:*:*:*:*:*h5.0.1.2348 build_20230324VulnerableQNAP
cpe:2.3:o:qnap:qutscloud:c5.0.0.1919:build_20220119:*:*:*:*:*:*c5.0.0.1919 build_20220119VulnerableQNAP
cpe:2.3:o:qnap:qutscloud:c5.0.1.1949:build_20220218:*:*:*:*:*:*c5.0.1.1949 build_20220218VulnerableQNAP
cpe:2.3:o:qnap:qutscloud:c5.0.1.1998:build_20220408:*:*:*:*:*:*c5.0.1.1998 build_20220408VulnerableQNAP
cpe:2.3:o:qnap:qutscloud:c5.0.1.2044:build_20220524:*:*:*:*:*:*c5.0.1.2044 build_20220524VulnerableQNAP
cpe:2.3:o:qnap:qutscloud:c5.0.1.2148:build_20220905:*:*:*:*:*:*c5.0.1.2148 build_20220905VulnerableQNAP
cpe:2.3:o:qnap:qutscloud:c5.0.1.2374:build_20230419:*:*:*:*:*:*c5.0.1.2374 build_20230419VulnerableQNAP
  • cpe:2.3:o:qnap:qts:5.0.1.2079:build_20220629:*:*:*:*:*:* Versions 5.0.1.2079 build_20220629 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:5.0.1.2131:build_20220820:*:*:*:*:*:* Versions 5.0.1.2131 build_20220820 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:5.0.1.2137:build_20220826:*:*:*:*:*:* Versions 5.0.1.2137 build_20220826 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:5.0.1.2145:build_20220903:*:*:*:*:*:* Versions 5.0.1.2145 build_20220903 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:5.0.1.2173:build_20221001:*:*:*:*:*:* Versions 5.0.1.2173 build_20221001 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:5.0.1.2194:build_20221022:*:*:*:*:*:* Versions 5.0.1.2194 build_20221022 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:5.0.1.2234:build_20221201:*:*:*:*:*:* Versions 5.0.1.2234 build_20221201 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:5.0.1.2248:build_20221215:*:*:*:*:*:* Versions 5.0.1.2248 build_20221215 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:5.0.1.2277:build_20230112:*:*:*:*:*:* Versions 5.0.1.2277 build_20230112 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:5.0.1.2346:build_20230322:*:*:*:*:*:* Versions 5.0.1.2346 build_20230322 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:quts_hero:h5.0.0.1772:build_20210826:*:*:*:*:*:* Versions h5.0.0.1772 build_20210826 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:quts_hero:h5.0.0.1844:build_20211105:*:*:*:*:*:* Versions h5.0.0.1844 build_20211105 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:quts_hero:h5.0.0.1856:build_20211117:*:*:*:*:*:* Versions h5.0.0.1856 build_20211117 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:quts_hero:h5.0.0.1892:build_20211222:*:*:*:*:*:* Versions h5.0.0.1892 build_20211222 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:quts_hero:h5.0.0.1900:build_20211228:*:*:*:*:*:* Versions h5.0.0.1900 build_20211228 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:quts_hero:h5.0.0.1949:build_20220215:*:*:*:*:*:* Versions h5.0.0.1949 build_20220215 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:quts_hero:h5.0.0.1986:build_20220324:*:*:*:*:*:* Versions h5.0.0.1986 build_20220324 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:quts_hero:h5.0.0.2022:build_20220428:*:*:*:*:*:* Versions h5.0.0.2022 build_20220428 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:quts_hero:h5.0.0.2069:build_20220614:*:*:*:*:*:* Versions h5.0.0.2069 build_20220614 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:quts_hero:h5.0.0.2120:build_20220804:*:*:*:*:*:* Versions h5.0.0.2120 build_20220804 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:quts_hero:h5.0.1.2045:build_20220526:*:*:*:*:*:* Versions h5.0.1.2045 build_20220526 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:quts_hero:h5.0.1.2192:build_20221020:*:*:*:*:*:* Versions h5.0.1.2192 build_20221020 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:quts_hero:h5.0.1.2248:build_20221215:*:*:*:*:*:* Versions h5.0.1.2248 build_20221215 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:quts_hero:h5.0.1.2269:build_20230104:*:*:*:*:*:* Versions h5.0.1.2269 build_20230104 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:quts_hero:h5.0.1.2277:build_20230112:*:*:*:*:*:* Versions h5.0.1.2277 build_20230112 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:quts_hero:h5.0.1.2348:build_20230324:*:*:*:*:*:* Versions h5.0.1.2348 build_20230324 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qutscloud:c5.0.0.1919:build_20220119:*:*:*:*:*:* Versions c5.0.0.1919 build_20220119 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qutscloud:c5.0.1.1949:build_20220218:*:*:*:*:*:* Versions c5.0.1.1949 build_20220218 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qutscloud:c5.0.1.1998:build_20220408:*:*:*:*:*:* Versions c5.0.1.1998 build_20220408 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qutscloud:c5.0.1.2044:build_20220524:*:*:*:*:*:* Versions c5.0.1.2044 build_20220524 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qutscloud:c5.0.1.2148:build_20220905:*:*:*:*:*:* Versions c5.0.1.2148 build_20220905 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qutscloud:c5.0.1.2374:build_20230419:*:*:*:*:*:* Versions c5.0.1.2374 build_20230419 Vulnerable ·QNAP

Remediation

  • Fix · CNA QTS (QNAP Systems Inc.) Fixed in 5.0.1.2376 build 20230421
  • Fix · CNA QuTS hero (QNAP Systems Inc.) Fixed in h5.0.1.2376 build 20230421
  • Fix · CNA QuTScloud (QNAP Systems Inc.) Fixed in c5.1.0.2498

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-23367
  2. 2026-10-03 Alias added: GHSA-p49w-7qqv-rf9v

References

Advisory 1

  • TI-2020-02221 Command Injection Vulnerability in QTS and QuTS hero KEVCVSS 3.1CRITICAL 9.8
  • TI-2019-05101 Improper input validation in QNAP NAS devices KEVCVSS 3.1CRITICAL 9.8
  • TI-2018-14137 Improper input validation in QNAP QTS KEVCVSS 3.1CRITICAL 9.8
  • TI-2014-05975 GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed… KEVCVSS 3.1CRITICAL 9.8
  • TI-2014-05157 GNU Bash through 4.3 processes trailing strings after function definitions in the values… KEVCVSS 3.1CRITICAL 9.8
  • TI-2018-14131 Cross-site scripting in QNAP QTS KEVCVSS 3.1HIGH 8.0
See all 282 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences