Read the docs
TI-2023-20444 Aliases CVE-2023-39300GHSA-3849-c8qc-jg4v

OS command injection in QNAP QTS

Priority LOW 36CWE-78Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-78.

Summary

An OS command injection vulnerability has been reported to affect legacy QTS. If exploited, the vulnerability could allow authenticated administrators to execute commands via a network. We have already fixed the vulnerability in the following versions: QTS 4.3.6.2805 build 20240619 and later QTS 4.3.4.2814 build 20240618 and later QTS 4.3.3.2784 build 20240619 and later QTS 4.2.6 build 20240618 and later

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01212 68th percentileScored 2026-11-07
Fix Fixed QTS (QNAP Systems Inc.): 4.3.6.2805 build 20240619, 4.3.4.2814 build 20240618, 4.3.3.2784 build 20240619 +3QuTS hero (QNAP Systems Inc.): h5.x, h4.5.x+1 more product

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
QNAPQTS4.3.6 to before 4.3.6.2805 build 20240619; 4.3.4 to before 4.3.4.2814 build 20240618; 4.3.3 to before 4.3.3.2784 build 20240619; 4.2.6 to before 4.2.6 build 202406184.3.6.2805 build 20240619, 4.3.4.2814 build 20240618, 4.3.3.2784 build 20240619, 4.2.6 build 20240618Patch availableCNA
QNAPQTS—5.x, 4.5.xPatch availableCNA
QNAPQuTS hero—h5.x, h4.5.xPatch availableCNA
QNAPQuTScloud—c5.xPatch availableCNA
  • QTS VendorQNAP Affected 4.3.6 to before 4.3.6.2805 build 20240619; 4.3.4 to before 4.3.4.2814 build 20240618; 4.3.3 to before 4.3.3.2784 build 20240619; 4.2.6 to before 4.2.6 build 20240618 Fixed in 4.3.6.2805 build 20240619, 4.3.4.2814 build 20240618, 4.3.3.2784 build 20240619, 4.2.6 build 20240618 Patch available CNA
  • QTS VendorQNAP Affected — Fixed in 5.x, 4.5.x Patch available CNA
  • QuTS hero VendorQNAP Affected — Fixed in h5.x, h4.5.x Patch available CNA
  • QuTScloud VendorQNAP Affected — Fixed in c5.x Patch available CNA

CPE configurations NVD · 79

CPEVersionsRoleVendor
cpe:2.3:o:qnap:qts:4.3.6.0895:build_20190328:*:*:*:*:*:*4.3.6.0895 build_20190328VulnerableQNAP
cpe:2.3:o:qnap:qts:4.3.6.0907:build_20190409:*:*:*:*:*:*4.3.6.0907 build_20190409VulnerableQNAP
cpe:2.3:o:qnap:qts:4.3.6.0923:build_20190425:*:*:*:*:*:*4.3.6.0923 build_20190425VulnerableQNAP
cpe:2.3:o:qnap:qts:4.3.6.0944:build_20190516:*:*:*:*:*:*4.3.6.0944 build_20190516VulnerableQNAP
cpe:2.3:o:qnap:qts:4.3.6.0959:build_20190531:*:*:*:*:*:*4.3.6.0959 build_20190531VulnerableQNAP
cpe:2.3:o:qnap:qts:4.3.6.0979:build_20190620:*:*:*:*:*:*4.3.6.0979 build_20190620VulnerableQNAP
cpe:2.3:o:qnap:qts:4.3.6.0993:build_20190704:*:*:*:*:*:*4.3.6.0993 build_20190704VulnerableQNAP
cpe:2.3:o:qnap:qts:4.3.6.1013:build_20190724:*:*:*:*:*:*4.3.6.1013 build_20190724VulnerableQNAP
cpe:2.3:o:qnap:qts:4.3.6.1033:build_20190813:*:*:*:*:*:*4.3.6.1033 build_20190813VulnerableQNAP
cpe:2.3:o:qnap:qts:4.3.6.1070:build_20190919:*:*:*:*:*:*4.3.6.1070 build_20190919VulnerableQNAP
  • cpe:2.3:o:qnap:qts:4.3.6.0895:build_20190328:*:*:*:*:*:* Versions 4.3.6.0895 build_20190328 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.6.0907:build_20190409:*:*:*:*:*:* Versions 4.3.6.0907 build_20190409 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.6.0923:build_20190425:*:*:*:*:*:* Versions 4.3.6.0923 build_20190425 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.6.0944:build_20190516:*:*:*:*:*:* Versions 4.3.6.0944 build_20190516 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.6.0959:build_20190531:*:*:*:*:*:* Versions 4.3.6.0959 build_20190531 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.6.0979:build_20190620:*:*:*:*:*:* Versions 4.3.6.0979 build_20190620 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.6.0993:build_20190704:*:*:*:*:*:* Versions 4.3.6.0993 build_20190704 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.6.1013:build_20190724:*:*:*:*:*:* Versions 4.3.6.1013 build_20190724 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.6.1033:build_20190813:*:*:*:*:*:* Versions 4.3.6.1033 build_20190813 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.6.1070:build_20190919:*:*:*:*:*:* Versions 4.3.6.1070 build_20190919 Vulnerable ·QNAP
Show 69 more CPE
CPEVersionsRoleVendor
cpe:2.3:o:qnap:qts:4.3.6.1154:build_20191212:*:*:*:*:*:*4.3.6.1154 build_20191212VulnerableQNAP
cpe:2.3:o:qnap:qts:4.3.6.1218:build_20200214:*:*:*:*:*:*4.3.6.1218 build_20200214VulnerableQNAP
cpe:2.3:o:qnap:qts:4.3.6.1263:build_20200330:*:*:*:*:*:*4.3.6.1263 build_20200330VulnerableQNAP
cpe:2.3:o:qnap:qts:4.3.6.1286:build_20200422:*:*:*:*:*:*4.3.6.1286 build_20200422VulnerableQNAP
cpe:2.3:o:qnap:qts:4.3.6.1333:build_20200608:*:*:*:*:*:*4.3.6.1333 build_20200608VulnerableQNAP
cpe:2.3:o:qnap:qts:4.3.6.1411:build_20200825:*:*:*:*:*:*4.3.6.1411 build_20200825VulnerableQNAP
cpe:2.3:o:qnap:qts:4.3.6.1446:build_20200929:*:*:*:*:*:*4.3.6.1446 build_20200929VulnerableQNAP
cpe:2.3:o:qnap:qts:4.3.6.1620:build_20210322:*:*:*:*:*:*4.3.6.1620 build_20210322VulnerableQNAP
cpe:2.3:o:qnap:qts:4.3.6.1663:build_20210504:*:*:*:*:*:*4.3.6.1663 build_20210504VulnerableQNAP
cpe:2.3:o:qnap:qts:4.3.6.1711:build_20210621:*:*:*:*:*:*4.3.6.1711 build_20210621VulnerableQNAP
cpe:2.3:o:qnap:qts:4.3.6.1750:build_20210730:*:*:*:*:*:*4.3.6.1750 build_20210730VulnerableQNAP
cpe:2.3:o:qnap:qts:4.3.6.1831:build_20211019:*:*:*:*:*:*4.3.6.1831 build_20211019VulnerableQNAP
cpe:2.3:o:qnap:qts:4.3.6.1907:build_20220103:*:*:*:*:*:*4.3.6.1907 build_20220103VulnerableQNAP
cpe:2.3:o:qnap:qts:4.3.6.1965:build_20220302:*:*:*:*:*:*4.3.6.1965 build_20220302VulnerableQNAP
cpe:2.3:o:qnap:qts:4.3.6.2050:build_20220526:*:*:*:*:*:*4.3.6.2050 build_20220526VulnerableQNAP
cpe:2.3:o:qnap:qts:4.3.6.2232:build_20221124:*:*:*:*:*:*4.3.6.2232 build_20221124VulnerableQNAP
cpe:2.3:o:qnap:qts:4.3.6.2441:build_20230621:*:*:*:*:*:*4.3.6.2441 build_20230621VulnerableQNAP
cpe:2.3:o:qnap:qts:4.3.6.2665:build_20240131:*:*:*:*:*:*4.3.6.2665 build_20240131VulnerableQNAP
cpe:2.3:o:qnap:qts:4.3.4.0899:build_20190322:*:*:*:*:*:*4.3.4.0899 build_20190322VulnerableQNAP
cpe:2.3:o:qnap:qts:4.3.4.1029:build_20190730:*:*:*:*:*:*4.3.4.1029 build_20190730VulnerableQNAP
cpe:2.3:o:qnap:qts:4.3.4.1082:build_20190921:*:*:*:*:*:*4.3.4.1082 build_20190921VulnerableQNAP
cpe:2.3:o:qnap:qts:4.3.4.1190:build_20200107:*:*:*:*:*:*4.3.4.1190 build_20200107VulnerableQNAP
cpe:2.3:o:qnap:qts:4.3.4.1282:build_20200408:*:*:*:*:*:*4.3.4.1282 build_20200408VulnerableQNAP
cpe:2.3:o:qnap:qts:4.3.4.1368:build_20200703:*:*:*:*:*:*4.3.4.1368 build_20200703VulnerableQNAP
cpe:2.3:o:qnap:qts:4.3.4.1417:build_20200821:*:*:*:*:*:*4.3.4.1417 build_20200821VulnerableQNAP
cpe:2.3:o:qnap:qts:4.3.4.1463:build_20201006:*:*:*:*:*:*4.3.4.1463 build_20201006VulnerableQNAP
cpe:2.3:o:qnap:qts:4.3.4.1632:build_20210324:*:*:*:*:*:*4.3.4.1632 build_20210324VulnerableQNAP
cpe:2.3:o:qnap:qts:4.3.4.1652:build_20210413:*:*:*:*:*:*4.3.4.1652 build_20210413VulnerableQNAP
cpe:2.3:o:qnap:qts:4.3.4.1976:build_20220303:*:*:*:*:*:*4.3.4.1976 build_20220303VulnerableQNAP
cpe:2.3:o:qnap:qts:4.3.4.2107:build_20220712:*:*:*:*:*:*4.3.4.2107 build_20220712VulnerableQNAP
cpe:2.3:o:qnap:qts:4.3.4.2242:build_20221124:*:*:*:*:*:*4.3.4.2242 build_20221124VulnerableQNAP
cpe:2.3:o:qnap:qts:4.3.4.2451:build_20230621:*:*:*:*:*:*4.3.4.2451 build_20230621VulnerableQNAP
cpe:2.3:o:qnap:qts:4.3.4.2675:build_20240131:*:*:*:*:*:*4.3.4.2675 build_20240131VulnerableQNAP
cpe:2.3:o:qnap:qts:4.3.3.0174:build_20170503:*:*:*:*:*:*4.3.3.0174 build_20170503VulnerableQNAP
cpe:2.3:o:qnap:qts:4.3.3.0868:build_20190322:*:*:*:*:*:*4.3.3.0868 build_20190322VulnerableQNAP
cpe:2.3:o:qnap:qts:4.3.3.0998:build_20190730:*:*:*:*:*:*4.3.3.0998 build_20190730VulnerableQNAP
cpe:2.3:o:qnap:qts:4.3.3.1051:build_20190921:*:*:*:*:*:*4.3.3.1051 build_20190921VulnerableQNAP
cpe:2.3:o:qnap:qts:4.3.3.1098:build_20191107:*:*:*:*:*:*4.3.3.1098 build_20191107VulnerableQNAP
cpe:2.3:o:qnap:qts:4.3.3.1161:build_20200109:*:*:*:*:*:*4.3.3.1161 build_20200109VulnerableQNAP
cpe:2.3:o:qnap:qts:4.3.3.1252:build_20200409:*:*:*:*:*:*4.3.3.1252 build_20200409VulnerableQNAP
cpe:2.3:o:qnap:qts:4.3.3.1315:build_20200611:*:*:*:*:*:*4.3.3.1315 build_20200611VulnerableQNAP
cpe:2.3:o:qnap:qts:4.3.3.1386:build_20200821:*:*:*:*:*:*4.3.3.1386 build_20200821VulnerableQNAP
cpe:2.3:o:qnap:qts:4.3.3.1432:build_20201006:*:*:*:*:*:*4.3.3.1432 build_20201006VulnerableQNAP
cpe:2.3:o:qnap:qts:4.3.3.1624:build_20210416:*:*:*:*:*:*4.3.3.1624 build_20210416VulnerableQNAP
cpe:2.3:o:qnap:qts:4.3.3.1677:build_20210608:*:*:*:*:*:*4.3.3.1677 build_20210608VulnerableQNAP
cpe:2.3:o:qnap:qts:4.3.3.1693:build_20210624:*:*:*:*:*:*4.3.3.1693 build_20210624VulnerableQNAP
cpe:2.3:o:qnap:qts:4.3.3.1799:build_20211008:*:*:*:*:*:*4.3.3.1799 build_20211008VulnerableQNAP
cpe:2.3:o:qnap:qts:4.3.3.1864:build_20211212:*:*:*:*:*:*4.3.3.1864 build_20211212VulnerableQNAP
cpe:2.3:o:qnap:qts:4.3.3.1945:build_20220303:*:*:*:*:*:*4.3.3.1945 build_20220303VulnerableQNAP
cpe:2.3:o:qnap:qts:4.3.3.2057:build_20220623:*:*:*:*:*:*4.3.3.2057 build_20220623VulnerableQNAP
cpe:2.3:o:qnap:qts:4.3.3.2211:build_20221124:*:*:*:*:*:*4.3.3.2211 build_20221124VulnerableQNAP
cpe:2.3:o:qnap:qts:4.3.3.2420:build_20230621:*:*:*:*:*:*4.3.3.2420 build_20230621VulnerableQNAP
cpe:2.3:o:qnap:qts:4.3.3.2644:build_20240131:*:*:*:*:*:*4.3.3.2644 build_20240131VulnerableQNAP
cpe:2.3:o:qnap:qts:4.2.6:build_20170517:*:*:*:*:*:*4.2.6 build_20170517VulnerableQNAP
cpe:2.3:o:qnap:qts:4.2.6:build_20190322:*:*:*:*:*:*4.2.6 build_20190322VulnerableQNAP
cpe:2.3:o:qnap:qts:4.2.6:build_20190730:*:*:*:*:*:*4.2.6 build_20190730VulnerableQNAP
cpe:2.3:o:qnap:qts:4.2.6:build_20190921:*:*:*:*:*:*4.2.6 build_20190921VulnerableQNAP
cpe:2.3:o:qnap:qts:4.2.6:build_20191107:*:*:*:*:*:*4.2.6 build_20191107VulnerableQNAP
cpe:2.3:o:qnap:qts:4.2.6:build_20200109:*:*:*:*:*:*4.2.6 build_20200109VulnerableQNAP
cpe:2.3:o:qnap:qts:4.2.6:build_20200421:*:*:*:*:*:*4.2.6 build_20200421VulnerableQNAP
cpe:2.3:o:qnap:qts:4.2.6:build_20200611:*:*:*:*:*:*4.2.6 build_20200611VulnerableQNAP
cpe:2.3:o:qnap:qts:4.2.6:build_20200821:*:*:*:*:*:*4.2.6 build_20200821VulnerableQNAP
cpe:2.3:o:qnap:qts:4.2.6:build_20210327:*:*:*:*:*:*4.2.6 build_20210327VulnerableQNAP
cpe:2.3:o:qnap:qts:4.2.6:build_20211215:*:*:*:*:*:*4.2.6 build_20211215VulnerableQNAP
cpe:2.3:o:qnap:qts:4.2.6:build_20220304:*:*:*:*:*:*4.2.6 build_20220304VulnerableQNAP
cpe:2.3:o:qnap:qts:4.2.6:build_20220623:*:*:*:*:*:*4.2.6 build_20220623VulnerableQNAP
cpe:2.3:o:qnap:qts:4.2.6:build_20221028:*:*:*:*:*:*4.2.6 build_20221028VulnerableQNAP
cpe:2.3:o:qnap:qts:4.2.6:build_20230621:*:*:*:*:*:*4.2.6 build_20230621VulnerableQNAP
cpe:2.3:o:qnap:qts:4.2.6:build_20240131:*:*:*:*:*:*4.2.6 build_20240131VulnerableQNAP
  • cpe:2.3:o:qnap:qts:4.3.6.1154:build_20191212:*:*:*:*:*:* Versions 4.3.6.1154 build_20191212 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.6.1218:build_20200214:*:*:*:*:*:* Versions 4.3.6.1218 build_20200214 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.6.1263:build_20200330:*:*:*:*:*:* Versions 4.3.6.1263 build_20200330 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.6.1286:build_20200422:*:*:*:*:*:* Versions 4.3.6.1286 build_20200422 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.6.1333:build_20200608:*:*:*:*:*:* Versions 4.3.6.1333 build_20200608 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.6.1411:build_20200825:*:*:*:*:*:* Versions 4.3.6.1411 build_20200825 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.6.1446:build_20200929:*:*:*:*:*:* Versions 4.3.6.1446 build_20200929 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.6.1620:build_20210322:*:*:*:*:*:* Versions 4.3.6.1620 build_20210322 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.6.1663:build_20210504:*:*:*:*:*:* Versions 4.3.6.1663 build_20210504 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.6.1711:build_20210621:*:*:*:*:*:* Versions 4.3.6.1711 build_20210621 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.6.1750:build_20210730:*:*:*:*:*:* Versions 4.3.6.1750 build_20210730 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.6.1831:build_20211019:*:*:*:*:*:* Versions 4.3.6.1831 build_20211019 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.6.1907:build_20220103:*:*:*:*:*:* Versions 4.3.6.1907 build_20220103 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.6.1965:build_20220302:*:*:*:*:*:* Versions 4.3.6.1965 build_20220302 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.6.2050:build_20220526:*:*:*:*:*:* Versions 4.3.6.2050 build_20220526 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.6.2232:build_20221124:*:*:*:*:*:* Versions 4.3.6.2232 build_20221124 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.6.2441:build_20230621:*:*:*:*:*:* Versions 4.3.6.2441 build_20230621 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.6.2665:build_20240131:*:*:*:*:*:* Versions 4.3.6.2665 build_20240131 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.4.0899:build_20190322:*:*:*:*:*:* Versions 4.3.4.0899 build_20190322 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.4.1029:build_20190730:*:*:*:*:*:* Versions 4.3.4.1029 build_20190730 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.4.1082:build_20190921:*:*:*:*:*:* Versions 4.3.4.1082 build_20190921 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.4.1190:build_20200107:*:*:*:*:*:* Versions 4.3.4.1190 build_20200107 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.4.1282:build_20200408:*:*:*:*:*:* Versions 4.3.4.1282 build_20200408 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.4.1368:build_20200703:*:*:*:*:*:* Versions 4.3.4.1368 build_20200703 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.4.1417:build_20200821:*:*:*:*:*:* Versions 4.3.4.1417 build_20200821 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.4.1463:build_20201006:*:*:*:*:*:* Versions 4.3.4.1463 build_20201006 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.4.1632:build_20210324:*:*:*:*:*:* Versions 4.3.4.1632 build_20210324 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.4.1652:build_20210413:*:*:*:*:*:* Versions 4.3.4.1652 build_20210413 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.4.1976:build_20220303:*:*:*:*:*:* Versions 4.3.4.1976 build_20220303 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.4.2107:build_20220712:*:*:*:*:*:* Versions 4.3.4.2107 build_20220712 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.4.2242:build_20221124:*:*:*:*:*:* Versions 4.3.4.2242 build_20221124 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.4.2451:build_20230621:*:*:*:*:*:* Versions 4.3.4.2451 build_20230621 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.4.2675:build_20240131:*:*:*:*:*:* Versions 4.3.4.2675 build_20240131 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.3.0174:build_20170503:*:*:*:*:*:* Versions 4.3.3.0174 build_20170503 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.3.0868:build_20190322:*:*:*:*:*:* Versions 4.3.3.0868 build_20190322 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.3.0998:build_20190730:*:*:*:*:*:* Versions 4.3.3.0998 build_20190730 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.3.1051:build_20190921:*:*:*:*:*:* Versions 4.3.3.1051 build_20190921 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.3.1098:build_20191107:*:*:*:*:*:* Versions 4.3.3.1098 build_20191107 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.3.1161:build_20200109:*:*:*:*:*:* Versions 4.3.3.1161 build_20200109 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.3.1252:build_20200409:*:*:*:*:*:* Versions 4.3.3.1252 build_20200409 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.3.1315:build_20200611:*:*:*:*:*:* Versions 4.3.3.1315 build_20200611 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.3.1386:build_20200821:*:*:*:*:*:* Versions 4.3.3.1386 build_20200821 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.3.1432:build_20201006:*:*:*:*:*:* Versions 4.3.3.1432 build_20201006 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.3.1624:build_20210416:*:*:*:*:*:* Versions 4.3.3.1624 build_20210416 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.3.1677:build_20210608:*:*:*:*:*:* Versions 4.3.3.1677 build_20210608 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.3.1693:build_20210624:*:*:*:*:*:* Versions 4.3.3.1693 build_20210624 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.3.1799:build_20211008:*:*:*:*:*:* Versions 4.3.3.1799 build_20211008 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.3.1864:build_20211212:*:*:*:*:*:* Versions 4.3.3.1864 build_20211212 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.3.1945:build_20220303:*:*:*:*:*:* Versions 4.3.3.1945 build_20220303 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.3.2057:build_20220623:*:*:*:*:*:* Versions 4.3.3.2057 build_20220623 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.3.2211:build_20221124:*:*:*:*:*:* Versions 4.3.3.2211 build_20221124 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.3.2420:build_20230621:*:*:*:*:*:* Versions 4.3.3.2420 build_20230621 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.3.2644:build_20240131:*:*:*:*:*:* Versions 4.3.3.2644 build_20240131 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.2.6:build_20170517:*:*:*:*:*:* Versions 4.2.6 build_20170517 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.2.6:build_20190322:*:*:*:*:*:* Versions 4.2.6 build_20190322 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.2.6:build_20190730:*:*:*:*:*:* Versions 4.2.6 build_20190730 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.2.6:build_20190921:*:*:*:*:*:* Versions 4.2.6 build_20190921 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.2.6:build_20191107:*:*:*:*:*:* Versions 4.2.6 build_20191107 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.2.6:build_20200109:*:*:*:*:*:* Versions 4.2.6 build_20200109 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.2.6:build_20200421:*:*:*:*:*:* Versions 4.2.6 build_20200421 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.2.6:build_20200611:*:*:*:*:*:* Versions 4.2.6 build_20200611 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.2.6:build_20200821:*:*:*:*:*:* Versions 4.2.6 build_20200821 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.2.6:build_20210327:*:*:*:*:*:* Versions 4.2.6 build_20210327 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.2.6:build_20211215:*:*:*:*:*:* Versions 4.2.6 build_20211215 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.2.6:build_20220304:*:*:*:*:*:* Versions 4.2.6 build_20220304 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.2.6:build_20220623:*:*:*:*:*:* Versions 4.2.6 build_20220623 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.2.6:build_20221028:*:*:*:*:*:* Versions 4.2.6 build_20221028 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.2.6:build_20230621:*:*:*:*:*:* Versions 4.2.6 build_20230621 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.2.6:build_20240131:*:*:*:*:*:* Versions 4.2.6 build_20240131 Vulnerable ·QNAP

Remediation

  • Fix · CNA QTS (QNAP Systems Inc.) Fixed in 4.3.6.2805 build 20240619, 4.3.4.2814 build 20240618, 4.3.3.2784 build 20240619, 4.2.6 build 20240618
  • Fix · CNA QTS (QNAP Systems Inc.) Fixed in 5.x, 4.5.x
  • Fix · CNA QuTS hero (QNAP Systems Inc.) Fixed in h5.x, h4.5.x
  • Fix · CNA QuTScloud (QNAP Systems Inc.) Fixed in c5.x

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-39300
  2. 2026-10-03 Alias added: GHSA-3849-c8qc-jg4v

References

Advisory 1

  • TI-2020-02221 Command Injection Vulnerability in QTS and QuTS hero KEVCVSS 3.1CRITICAL 9.8
  • TI-2019-05101 Improper input validation in QNAP NAS devices KEVCVSS 3.1CRITICAL 9.8
  • TI-2018-14137 Improper input validation in QNAP QTS KEVCVSS 3.1CRITICAL 9.8
  • TI-2014-05975 GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed… KEVCVSS 3.1CRITICAL 9.8
  • TI-2014-05157 GNU Bash through 4.3 processes trailing strings after function definitions in the values… KEVCVSS 3.1CRITICAL 9.8
  • TI-2018-14131 Cross-site scripting in QNAP QTS KEVCVSS 3.1HIGH 8.0
See all 282 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences