Read the docs
TI-2023-17464 Aliases CVE-2023-34974GHSA-v52j-76fx-xfcf

OS command injection in QNAP QTS

Priority MEDIUM 42CWE-78Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-78.

Summary

An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow users to execute commands via a network. QuTScloud, QVR, QES are not affected. We have already fixed the vulnerability in the following versions: QTS 4.5.4.2790 build 20240605 and later QuTS hero h4.5.4.2626 build 20231225 and later

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00994 62nd percentileScored 2026-11-07
Fix Fixed QTS (QNAP Systems Inc.): 4.5.4.2790 build 20240605QuTS hero (QNAP Systems Inc.): h4.5.4.2626 build 20231225+3 more products

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
QNAPQTS4.5.x to before 4.5.4.2790 build 202406054.5.4.2790 build 20240605Patch availableCNA
QNAPQuTS heroh4.5.x to before h4.5.4.2626 build 20231225h4.5.4.2626 build 20231225Patch availableCNA
QNAPQuTScloud—c5.x.xPatch availableCNA
QNAPQVR—5.1.0Patch availableCNA
QNAPQES—2.2.0Patch availableCNA
  • QTS VendorQNAP Affected 4.5.x to before 4.5.4.2790 build 20240605 Fixed in 4.5.4.2790 build 20240605 Patch available CNA
  • QuTS hero VendorQNAP Affected h4.5.x to before h4.5.4.2626 build 20231225 Fixed in h4.5.4.2626 build 20231225 Patch available CNA
  • QuTScloud VendorQNAP Affected — Fixed in c5.x.x Patch available CNA
  • QVR VendorQNAP Affected — Fixed in 5.1.0 Patch available CNA
  • QES VendorQNAP Affected — Fixed in 2.2.0 Patch available CNA

CPE configurations NVD · 28

CPEVersionsRoleVendor
cpe:2.3:o:qnap:qts:4.5.4.1715:build_20210630:*:*:*:*:*:*4.5.4.1715 build_20210630VulnerableQNAP
cpe:2.3:o:qnap:qts:4.5.4.1723:build_20210708:*:*:*:*:*:*4.5.4.1723 build_20210708VulnerableQNAP
cpe:2.3:o:qnap:qts:4.5.4.1741:build_20210726:*:*:*:*:*:*4.5.4.1741 build_20210726VulnerableQNAP
cpe:2.3:o:qnap:qts:4.5.4.1787:build_20210910:*:*:*:*:*:*4.5.4.1787 build_20210910VulnerableQNAP
cpe:2.3:o:qnap:qts:4.5.4.1800:build_20210923:*:*:*:*:*:*4.5.4.1800 build_20210923VulnerableQNAP
cpe:2.3:o:qnap:qts:4.5.4.1892:build_20211223:*:*:*:*:*:*4.5.4.1892 build_20211223VulnerableQNAP
cpe:2.3:o:qnap:qts:4.5.4.1931:build_20220128:*:*:*:*:*:*4.5.4.1931 build_20220128VulnerableQNAP
cpe:2.3:o:qnap:qts:4.5.4.2012:build_20220419:*:*:*:*:*:*4.5.4.2012 build_20220419VulnerableQNAP
cpe:2.3:o:qnap:qts:4.5.4.2117:build_20220802:*:*:*:*:*:*4.5.4.2117 build_20220802VulnerableQNAP
cpe:2.3:o:qnap:qts:4.5.4.2280:build_20230112:*:*:*:*:*:*4.5.4.2280 build_20230112VulnerableQNAP
  • cpe:2.3:o:qnap:qts:4.5.4.1715:build_20210630:*:*:*:*:*:* Versions 4.5.4.1715 build_20210630 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.5.4.1723:build_20210708:*:*:*:*:*:* Versions 4.5.4.1723 build_20210708 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.5.4.1741:build_20210726:*:*:*:*:*:* Versions 4.5.4.1741 build_20210726 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.5.4.1787:build_20210910:*:*:*:*:*:* Versions 4.5.4.1787 build_20210910 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.5.4.1800:build_20210923:*:*:*:*:*:* Versions 4.5.4.1800 build_20210923 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.5.4.1892:build_20211223:*:*:*:*:*:* Versions 4.5.4.1892 build_20211223 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.5.4.1931:build_20220128:*:*:*:*:*:* Versions 4.5.4.1931 build_20220128 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.5.4.2012:build_20220419:*:*:*:*:*:* Versions 4.5.4.2012 build_20220419 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.5.4.2117:build_20220802:*:*:*:*:*:* Versions 4.5.4.2117 build_20220802 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.5.4.2280:build_20230112:*:*:*:*:*:* Versions 4.5.4.2280 build_20230112 Vulnerable ·QNAP
Show 18 more CPE
CPEVersionsRoleVendor
cpe:2.3:o:qnap:qts:4.5.4.2374:build_20230416:*:*:*:*:*:*4.5.4.2374 build_20230416VulnerableQNAP
cpe:2.3:o:qnap:qts:4.5.4.2467:build_20230718:*:*:*:*:*:*4.5.4.2467 build_20230718VulnerableQNAP
cpe:2.3:o:qnap:qts:4.5.4.2627:build_20231225:*:*:*:*:*:*4.5.4.2627 build_20231225VulnerableQNAP
cpe:2.3:o:qnap:quts_hero:h4.5.4.1771:build_20210825:*:*:*:*:*:*h4.5.4.1771 build_20210825VulnerableQNAP
cpe:2.3:o:qnap:quts_hero:h4.5.4.1800:build_20210923:*:*:*:*:*:*h4.5.4.1800 build_20210923VulnerableQNAP
cpe:2.3:o:qnap:quts_hero:h4.5.4.1813:build_20211006:*:*:*:*:*:*h4.5.4.1813 build_20211006VulnerableQNAP
cpe:2.3:o:qnap:quts_hero:h4.5.4.1848:build_20211109:*:*:*:*:*:*h4.5.4.1848 build_20211109VulnerableQNAP
cpe:2.3:o:qnap:quts_hero:h4.5.4.1892:build_20211223:*:*:*:*:*:*h4.5.4.1892 build_20211223VulnerableQNAP
cpe:2.3:o:qnap:quts_hero:h4.5.4.1951:build_20220218:*:*:*:*:*:*h4.5.4.1951 build_20220218VulnerableQNAP
cpe:2.3:o:qnap:quts_hero:h4.5.4.1971:build_20220310:*:*:*:*:*:*h4.5.4.1971 build_20220310VulnerableQNAP
cpe:2.3:o:qnap:quts_hero:h4.5.4.1991:build_20220330:*:*:*:*:*:*h4.5.4.1991 build_20220330VulnerableQNAP
cpe:2.3:o:qnap:quts_hero:h4.5.4.2052:build_20220530:*:*:*:*:*:*h4.5.4.2052 build_20220530VulnerableQNAP
cpe:2.3:o:qnap:quts_hero:h4.5.4.2138:build_20220824:*:*:*:*:*:*h4.5.4.2138 build_20220824VulnerableQNAP
cpe:2.3:o:qnap:quts_hero:h4.5.4.2217:build_20221111:*:*:*:*:*:*h4.5.4.2217 build_20221111VulnerableQNAP
cpe:2.3:o:qnap:quts_hero:h4.5.4.2272:build_20230105:*:*:*:*:*:*h4.5.4.2272 build_20230105VulnerableQNAP
cpe:2.3:o:qnap:quts_hero:h4.5.4.2374:build_20230417:*:*:*:*:*:*h4.5.4.2374 build_20230417VulnerableQNAP
cpe:2.3:o:qnap:quts_hero:h4.5.4.2476:build_20230728:*:*:*:*:*:*h4.5.4.2476 build_20230728VulnerableQNAP
cpe:2.3:o:qnap:quts_hero:h4.5.4.2626:build_20231225:*:*:*:*:*:*h4.5.4.2626 build_20231225VulnerableQNAP
  • cpe:2.3:o:qnap:qts:4.5.4.2374:build_20230416:*:*:*:*:*:* Versions 4.5.4.2374 build_20230416 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.5.4.2467:build_20230718:*:*:*:*:*:* Versions 4.5.4.2467 build_20230718 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.5.4.2627:build_20231225:*:*:*:*:*:* Versions 4.5.4.2627 build_20231225 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:quts_hero:h4.5.4.1771:build_20210825:*:*:*:*:*:* Versions h4.5.4.1771 build_20210825 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:quts_hero:h4.5.4.1800:build_20210923:*:*:*:*:*:* Versions h4.5.4.1800 build_20210923 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:quts_hero:h4.5.4.1813:build_20211006:*:*:*:*:*:* Versions h4.5.4.1813 build_20211006 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:quts_hero:h4.5.4.1848:build_20211109:*:*:*:*:*:* Versions h4.5.4.1848 build_20211109 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:quts_hero:h4.5.4.1892:build_20211223:*:*:*:*:*:* Versions h4.5.4.1892 build_20211223 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:quts_hero:h4.5.4.1951:build_20220218:*:*:*:*:*:* Versions h4.5.4.1951 build_20220218 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:quts_hero:h4.5.4.1971:build_20220310:*:*:*:*:*:* Versions h4.5.4.1971 build_20220310 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:quts_hero:h4.5.4.1991:build_20220330:*:*:*:*:*:* Versions h4.5.4.1991 build_20220330 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:quts_hero:h4.5.4.2052:build_20220530:*:*:*:*:*:* Versions h4.5.4.2052 build_20220530 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:quts_hero:h4.5.4.2138:build_20220824:*:*:*:*:*:* Versions h4.5.4.2138 build_20220824 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:quts_hero:h4.5.4.2217:build_20221111:*:*:*:*:*:* Versions h4.5.4.2217 build_20221111 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:quts_hero:h4.5.4.2272:build_20230105:*:*:*:*:*:* Versions h4.5.4.2272 build_20230105 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:quts_hero:h4.5.4.2374:build_20230417:*:*:*:*:*:* Versions h4.5.4.2374 build_20230417 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:quts_hero:h4.5.4.2476:build_20230728:*:*:*:*:*:* Versions h4.5.4.2476 build_20230728 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:quts_hero:h4.5.4.2626:build_20231225:*:*:*:*:*:* Versions h4.5.4.2626 build_20231225 Vulnerable ·QNAP

Remediation

  • Fix · CNA QTS (QNAP Systems Inc.) Fixed in 4.5.4.2790 build 20240605
  • Fix · CNA QuTS hero (QNAP Systems Inc.) Fixed in h4.5.4.2626 build 20231225
  • Fix · CNA QuTScloud (QNAP Systems Inc.) Fixed in c5.x.x
  • Fix · CNA QVR (QNAP Systems Inc.) Fixed in 5.1.0
  • Fix · CNA QES (QNAP Systems Inc.) Fixed in 2.2.0

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    QNAP Systems QTS 4.5.4.2790 build 20240605

    2 records Highest priority Priority MEDIUM 1 MEDIUM, 1 LOW

    Other records, highest priority first

    Show all 2 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-34974
  2. 2026-10-03 Alias added: GHSA-v52j-76fx-xfcf

References

Advisory 1

  • TI-2020-02221 Command Injection Vulnerability in QTS and QuTS hero KEVCVSS 3.1CRITICAL 9.8
  • TI-2019-05101 Improper input validation in QNAP NAS devices KEVCVSS 3.1CRITICAL 9.8
  • TI-2018-14137 Improper input validation in QNAP QTS KEVCVSS 3.1CRITICAL 9.8
  • TI-2014-05975 GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed… KEVCVSS 3.1CRITICAL 9.8
  • TI-2014-05157 GNU Bash through 4.3 processes trailing strings after function definitions in the values… KEVCVSS 3.1CRITICAL 9.8
  • TI-2018-14131 Cross-site scripting in QNAP QTS KEVCVSS 3.1HIGH 8.0
See all 282 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences