Command injection in QNAP QTS
Priority MEDIUM 45CWE-77Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-77.
Summary
An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow users to execute commands via a network. We have already fixed the vulnerability in the following versions: QTS 5.1.4.2596 build 20231128 and later QTS 4.5.4.2627 build 20231225 and later QuTS hero h5.1.4.2596 build 20231128 and later QuTS hero h4.5.4.2626 build 20231225 and later QuTScloud c5.1.5.2651 and later
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01128 66th percentileScored 2026-11-07
Fix Fixed QTS (QNAP Systems Inc.): 5.1.4.2596 build 20231128, 4.5.4.2627 build 20231225QuTS hero (QNAP Systems Inc.): h5.1.4.2596 build 20231128, h4.5.4.2626 build 20231225+1 more product
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| QNAP | QTS | 5.1.x to before 5.1.4.2596 build 20231128; 4.5.x to before 4.5.4.2627 build 20231225 | 5.1.4.2596 build 20231128, 4.5.4.2627 build 20231225 | Patch available | CNA |
| QNAP | QuTS hero | h5.1.x to before h5.1.4.2596 build 20231128; h4.5.x to before h4.5.4.2626 build 20231225 | h5.1.4.2596 build 20231128, h4.5.4.2626 build 20231225 | Patch available | CNA |
| QNAP | QuTScloud | c5.x.x to before c5.1.5.2651 | c5.1.5.2651 | Patch available | CNA |
- QTS VendorQNAP Affected 5.1.x to before 5.1.4.2596 build 20231128; 4.5.x to before 4.5.4.2627 build 20231225 Fixed in 5.1.4.2596 build 20231128, 4.5.4.2627 build 20231225 Patch available CNA
- QuTS hero VendorQNAP Affected h5.1.x to before h5.1.4.2596 build 20231128; h4.5.x to before h4.5.4.2626 build 20231225 Fixed in h5.1.4.2596 build 20231128, h4.5.4.2626 build 20231225 Patch available CNA
- QuTScloud VendorQNAP Affected c5.x.x to before c5.1.5.2651 Fixed in c5.1.5.2651 Patch available CNA
CPE configurations NVD · 45
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:qnap:qts:4.5.4.1715:build_20210630:*:*:*:*:*:* | 4.5.4.1715 build_20210630 | Vulnerable | QNAP |
| cpe:2.3:o:qnap:qts:4.5.4.1723:build_20210708:*:*:*:*:*:* | 4.5.4.1723 build_20210708 | Vulnerable | QNAP |
| cpe:2.3:o:qnap:qts:4.5.4.1741:build_20210726:*:*:*:*:*:* | 4.5.4.1741 build_20210726 | Vulnerable | QNAP |
| cpe:2.3:o:qnap:qts:4.5.4.1787:build_20210910:*:*:*:*:*:* | 4.5.4.1787 build_20210910 | Vulnerable | QNAP |
| cpe:2.3:o:qnap:qts:4.5.4.1800:build_20210923:*:*:*:*:*:* | 4.5.4.1800 build_20210923 | Vulnerable | QNAP |
| cpe:2.3:o:qnap:qts:4.5.4.1892:build_20211223:*:*:*:*:*:* | 4.5.4.1892 build_20211223 | Vulnerable | QNAP |
| cpe:2.3:o:qnap:qts:4.5.4.1931:build_20220128:*:*:*:*:*:* | 4.5.4.1931 build_20220128 | Vulnerable | QNAP |
| cpe:2.3:o:qnap:qts:4.5.4.2012:build_20220419:*:*:*:*:*:* | 4.5.4.2012 build_20220419 | Vulnerable | QNAP |
| cpe:2.3:o:qnap:qts:4.5.4.2117:build_20220802:*:*:*:*:*:* | 4.5.4.2117 build_20220802 | Vulnerable | QNAP |
| cpe:2.3:o:qnap:qts:4.5.4.2280:build_20230112:*:*:*:*:*:* | 4.5.4.2280 build_20230112 | Vulnerable | QNAP |
- cpe:2.3:o:qnap:qts:4.5.4.1715:build_20210630:*:*:*:*:*:* Versions 4.5.4.1715 build_20210630 Vulnerable ·QNAP
- cpe:2.3:o:qnap:qts:4.5.4.1723:build_20210708:*:*:*:*:*:* Versions 4.5.4.1723 build_20210708 Vulnerable ·QNAP
- cpe:2.3:o:qnap:qts:4.5.4.1741:build_20210726:*:*:*:*:*:* Versions 4.5.4.1741 build_20210726 Vulnerable ·QNAP
- cpe:2.3:o:qnap:qts:4.5.4.1787:build_20210910:*:*:*:*:*:* Versions 4.5.4.1787 build_20210910 Vulnerable ·QNAP
- cpe:2.3:o:qnap:qts:4.5.4.1800:build_20210923:*:*:*:*:*:* Versions 4.5.4.1800 build_20210923 Vulnerable ·QNAP
- cpe:2.3:o:qnap:qts:4.5.4.1892:build_20211223:*:*:*:*:*:* Versions 4.5.4.1892 build_20211223 Vulnerable ·QNAP
- cpe:2.3:o:qnap:qts:4.5.4.1931:build_20220128:*:*:*:*:*:* Versions 4.5.4.1931 build_20220128 Vulnerable ·QNAP
- cpe:2.3:o:qnap:qts:4.5.4.2012:build_20220419:*:*:*:*:*:* Versions 4.5.4.2012 build_20220419 Vulnerable ·QNAP
- cpe:2.3:o:qnap:qts:4.5.4.2117:build_20220802:*:*:*:*:*:* Versions 4.5.4.2117 build_20220802 Vulnerable ·QNAP
- cpe:2.3:o:qnap:qts:4.5.4.2280:build_20230112:*:*:*:*:*:* Versions 4.5.4.2280 build_20230112 Vulnerable ·QNAP
Show 35 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:qnap:qts:4.5.4.2374:build_20230416:*:*:*:*:*:* | 4.5.4.2374 build_20230416 | Vulnerable | QNAP |
| cpe:2.3:o:qnap:qts:4.5.4.2627:-:*:*:*:*:*:* | 4.5.4.2627 | Vulnerable | QNAP |
| cpe:2.3:o:qnap:qts:5.1.0.2348:build_20230325:*:*:*:*:*:* | 5.1.0.2348 build_20230325 | Vulnerable | QNAP |
| cpe:2.3:o:qnap:qts:5.1.0.2399:build_20230515:*:*:*:*:*:* | 5.1.0.2399 build_20230515 | Vulnerable | QNAP |
| cpe:2.3:o:qnap:qts:5.1.0.2418:build_20230603:*:*:*:*:*:* | 5.1.0.2418 build_20230603 | Vulnerable | QNAP |
| cpe:2.3:o:qnap:qts:5.1.0.2444:build_20230629:*:*:*:*:*:* | 5.1.0.2444 build_20230629 | Vulnerable | QNAP |
| cpe:2.3:o:qnap:qts:5.1.0.2466:build_20230721:*:*:*:*:*:* | 5.1.0.2466 build_20230721 | Vulnerable | QNAP |
| cpe:2.3:o:qnap:qts:5.1.1.2491:build_20230815:*:*:*:*:*:* | 5.1.1.2491 build_20230815 | Vulnerable | QNAP |
| cpe:2.3:o:qnap:qts:5.1.2.2533:build_20230926:*:*:*:*:*:* | 5.1.2.2533 build_20230926 | Vulnerable | QNAP |
| cpe:2.3:o:qnap:qts:5.1.3.2578:build_20231110:*:*:*:*:*:* | 5.1.3.2578 build_20231110 | Vulnerable | QNAP |
| cpe:2.3:o:qnap:qts:5.1.4.2596:-:*:*:*:*:*:* | 5.1.4.2596 | Vulnerable | QNAP |
| cpe:2.3:o:qnap:quts_hero:h4.5.4.1771:build_20210825:*:*:*:*:*:* | h4.5.4.1771 build_20210825 | Vulnerable | QNAP |
| cpe:2.3:o:qnap:quts_hero:h4.5.4.1800:build_20210923:*:*:*:*:*:* | h4.5.4.1800 build_20210923 | Vulnerable | QNAP |
| cpe:2.3:o:qnap:quts_hero:h4.5.4.1813:build_20211006:*:*:*:*:*:* | h4.5.4.1813 build_20211006 | Vulnerable | QNAP |
| cpe:2.3:o:qnap:quts_hero:h4.5.4.1848:build_20211109:*:*:*:*:*:* | h4.5.4.1848 build_20211109 | Vulnerable | QNAP |
| cpe:2.3:o:qnap:quts_hero:h4.5.4.1892:build_20211223:*:*:*:*:*:* | h4.5.4.1892 build_20211223 | Vulnerable | QNAP |
| cpe:2.3:o:qnap:quts_hero:h4.5.4.1951:build_20220218:*:*:*:*:*:* | h4.5.4.1951 build_20220218 | Vulnerable | QNAP |
| cpe:2.3:o:qnap:quts_hero:h4.5.4.1971:build_20220310:*:*:*:*:*:* | h4.5.4.1971 build_20220310 | Vulnerable | QNAP |
| cpe:2.3:o:qnap:quts_hero:h4.5.4.1991:build_20220330:*:*:*:*:*:* | h4.5.4.1991 build_20220330 | Vulnerable | QNAP |
| cpe:2.3:o:qnap:quts_hero:h4.5.4.2052:build_20220530:*:*:*:*:*:* | h4.5.4.2052 build_20220530 | Vulnerable | QNAP |
| cpe:2.3:o:qnap:quts_hero:h4.5.4.2138:build_20220824:*:*:*:*:*:* | h4.5.4.2138 build_20220824 | Vulnerable | QNAP |
| cpe:2.3:o:qnap:quts_hero:h4.5.4.2217:build_20221111:*:*:*:*:*:* | h4.5.4.2217 build_20221111 | Vulnerable | QNAP |
| cpe:2.3:o:qnap:quts_hero:h4.5.4.2272:build_20230105:*:*:*:*:*:* | h4.5.4.2272 build_20230105 | Vulnerable | QNAP |
| cpe:2.3:o:qnap:quts_hero:h4.5.4.2374:build_20230417:*:*:*:*:*:* | h4.5.4.2374 build_20230417 | Vulnerable | QNAP |
| cpe:2.3:o:qnap:quts_hero:h4.5.4.2476:build_20230728:*:*:*:*:*:* | h4.5.4.2476 build_20230728 | Vulnerable | QNAP |
| cpe:2.3:o:qnap:quts_hero:h4.5.4.2626:-:*:*:*:*:*:* | h4.5.4.2626 | Vulnerable | QNAP |
| cpe:2.3:o:qnap:quts_hero:h5.1.0.2409:build_20230525:*:*:*:*:*:* | h5.1.0.2409 build_20230525 | Vulnerable | QNAP |
| cpe:2.3:o:qnap:quts_hero:h5.1.0.2424:build_20230609:*:*:*:*:*:* | h5.1.0.2424 build_20230609 | Vulnerable | QNAP |
| cpe:2.3:o:qnap:quts_hero:h5.1.0.2453:build_20230708:*:*:*:*:*:* | h5.1.0.2453 build_20230708 | Vulnerable | QNAP |
| cpe:2.3:o:qnap:quts_hero:h5.1.0.2466:build_20230721:*:*:*:*:*:* | h5.1.0.2466 build_20230721 | Vulnerable | QNAP |
| cpe:2.3:o:qnap:quts_hero:h5.1.1.2488:build_20230812:*:*:*:*:*:* | h5.1.1.2488 build_20230812 | Vulnerable | QNAP |
| cpe:2.3:o:qnap:quts_hero:h5.1.2.2534:build_20230927:*:*:*:*:*:* | h5.1.2.2534 build_20230927 | Vulnerable | QNAP |
| cpe:2.3:o:qnap:quts_hero:h5.1.3.2578:build_20231110:*:*:*:*:*:* | h5.1.3.2578 build_20231110 | Vulnerable | QNAP |
| cpe:2.3:o:qnap:quts_hero:h5.1.4.2596:-:*:*:*:*:*:* | h5.1.4.2596 | Vulnerable | QNAP |
| cpe:2.3:o:qnap:qutscloud:c5.1.0.2498:build_20230822:*:*:*:*:*:* | c5.1.0.2498 build_20230822 | Vulnerable | QNAP |
- cpe:2.3:o:qnap:qts:4.5.4.2374:build_20230416:*:*:*:*:*:* Versions 4.5.4.2374 build_20230416 Vulnerable ·QNAP
- cpe:2.3:o:qnap:qts:4.5.4.2627:-:*:*:*:*:*:* Versions 4.5.4.2627 Vulnerable ·QNAP
- cpe:2.3:o:qnap:qts:5.1.0.2348:build_20230325:*:*:*:*:*:* Versions 5.1.0.2348 build_20230325 Vulnerable ·QNAP
- cpe:2.3:o:qnap:qts:5.1.0.2399:build_20230515:*:*:*:*:*:* Versions 5.1.0.2399 build_20230515 Vulnerable ·QNAP
- cpe:2.3:o:qnap:qts:5.1.0.2418:build_20230603:*:*:*:*:*:* Versions 5.1.0.2418 build_20230603 Vulnerable ·QNAP
- cpe:2.3:o:qnap:qts:5.1.0.2444:build_20230629:*:*:*:*:*:* Versions 5.1.0.2444 build_20230629 Vulnerable ·QNAP
- cpe:2.3:o:qnap:qts:5.1.0.2466:build_20230721:*:*:*:*:*:* Versions 5.1.0.2466 build_20230721 Vulnerable ·QNAP
- cpe:2.3:o:qnap:qts:5.1.1.2491:build_20230815:*:*:*:*:*:* Versions 5.1.1.2491 build_20230815 Vulnerable ·QNAP
- cpe:2.3:o:qnap:qts:5.1.2.2533:build_20230926:*:*:*:*:*:* Versions 5.1.2.2533 build_20230926 Vulnerable ·QNAP
- cpe:2.3:o:qnap:qts:5.1.3.2578:build_20231110:*:*:*:*:*:* Versions 5.1.3.2578 build_20231110 Vulnerable ·QNAP
- cpe:2.3:o:qnap:qts:5.1.4.2596:-:*:*:*:*:*:* Versions 5.1.4.2596 Vulnerable ·QNAP
- cpe:2.3:o:qnap:quts_hero:h4.5.4.1771:build_20210825:*:*:*:*:*:* Versions h4.5.4.1771 build_20210825 Vulnerable ·QNAP
- cpe:2.3:o:qnap:quts_hero:h4.5.4.1800:build_20210923:*:*:*:*:*:* Versions h4.5.4.1800 build_20210923 Vulnerable ·QNAP
- cpe:2.3:o:qnap:quts_hero:h4.5.4.1813:build_20211006:*:*:*:*:*:* Versions h4.5.4.1813 build_20211006 Vulnerable ·QNAP
- cpe:2.3:o:qnap:quts_hero:h4.5.4.1848:build_20211109:*:*:*:*:*:* Versions h4.5.4.1848 build_20211109 Vulnerable ·QNAP
- cpe:2.3:o:qnap:quts_hero:h4.5.4.1892:build_20211223:*:*:*:*:*:* Versions h4.5.4.1892 build_20211223 Vulnerable ·QNAP
- cpe:2.3:o:qnap:quts_hero:h4.5.4.1951:build_20220218:*:*:*:*:*:* Versions h4.5.4.1951 build_20220218 Vulnerable ·QNAP
- cpe:2.3:o:qnap:quts_hero:h4.5.4.1971:build_20220310:*:*:*:*:*:* Versions h4.5.4.1971 build_20220310 Vulnerable ·QNAP
- cpe:2.3:o:qnap:quts_hero:h4.5.4.1991:build_20220330:*:*:*:*:*:* Versions h4.5.4.1991 build_20220330 Vulnerable ·QNAP
- cpe:2.3:o:qnap:quts_hero:h4.5.4.2052:build_20220530:*:*:*:*:*:* Versions h4.5.4.2052 build_20220530 Vulnerable ·QNAP
- cpe:2.3:o:qnap:quts_hero:h4.5.4.2138:build_20220824:*:*:*:*:*:* Versions h4.5.4.2138 build_20220824 Vulnerable ·QNAP
- cpe:2.3:o:qnap:quts_hero:h4.5.4.2217:build_20221111:*:*:*:*:*:* Versions h4.5.4.2217 build_20221111 Vulnerable ·QNAP
- cpe:2.3:o:qnap:quts_hero:h4.5.4.2272:build_20230105:*:*:*:*:*:* Versions h4.5.4.2272 build_20230105 Vulnerable ·QNAP
- cpe:2.3:o:qnap:quts_hero:h4.5.4.2374:build_20230417:*:*:*:*:*:* Versions h4.5.4.2374 build_20230417 Vulnerable ·QNAP
- cpe:2.3:o:qnap:quts_hero:h4.5.4.2476:build_20230728:*:*:*:*:*:* Versions h4.5.4.2476 build_20230728 Vulnerable ·QNAP
- cpe:2.3:o:qnap:quts_hero:h4.5.4.2626:-:*:*:*:*:*:* Versions h4.5.4.2626 Vulnerable ·QNAP
- cpe:2.3:o:qnap:quts_hero:h5.1.0.2409:build_20230525:*:*:*:*:*:* Versions h5.1.0.2409 build_20230525 Vulnerable ·QNAP
- cpe:2.3:o:qnap:quts_hero:h5.1.0.2424:build_20230609:*:*:*:*:*:* Versions h5.1.0.2424 build_20230609 Vulnerable ·QNAP
- cpe:2.3:o:qnap:quts_hero:h5.1.0.2453:build_20230708:*:*:*:*:*:* Versions h5.1.0.2453 build_20230708 Vulnerable ·QNAP
- cpe:2.3:o:qnap:quts_hero:h5.1.0.2466:build_20230721:*:*:*:*:*:* Versions h5.1.0.2466 build_20230721 Vulnerable ·QNAP
- cpe:2.3:o:qnap:quts_hero:h5.1.1.2488:build_20230812:*:*:*:*:*:* Versions h5.1.1.2488 build_20230812 Vulnerable ·QNAP
- cpe:2.3:o:qnap:quts_hero:h5.1.2.2534:build_20230927:*:*:*:*:*:* Versions h5.1.2.2534 build_20230927 Vulnerable ·QNAP
- cpe:2.3:o:qnap:quts_hero:h5.1.3.2578:build_20231110:*:*:*:*:*:* Versions h5.1.3.2578 build_20231110 Vulnerable ·QNAP
- cpe:2.3:o:qnap:quts_hero:h5.1.4.2596:-:*:*:*:*:*:* Versions h5.1.4.2596 Vulnerable ·QNAP
- cpe:2.3:o:qnap:qutscloud:c5.1.0.2498:build_20230822:*:*:*:*:*:* Versions c5.1.0.2498 build_20230822 Vulnerable ·QNAP
Remediation
- Fix · CNA QTS (QNAP Systems Inc.) Fixed in 5.1.4.2596 build 20231128, 4.5.4.2627 build 20231225
- Fix · CNA QuTS hero (QNAP Systems Inc.) Fixed in h5.1.4.2596 build 20231128, h4.5.4.2626 build 20231225
- Fix · CNA QuTScloud (QNAP Systems Inc.) Fixed in c5.1.5.2651
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
QNAP Systems QuTScloud c5.1.5.2651
26 records Highest priority Priority MEDIUM 5 MEDIUM, 21 LOW
Other records, highest priority first
- TI-2023-24080 Path traversal in QNAP QTSPriority MEDIUM 58
- TI-2023-20447 Improper authentication in QNAP QTSPriority MEDIUM 48
- TI-2023-20441 OS command injection in QNAP QTSPriority MEDIUM 43
- Release ·
QNAP Systems QTS, QuTS hero 4.5.4.2627 build 20231225, 5.1.4.2596 build 20231128 and 2 more versions
2 records Highest priority Priority MEDIUM 2 MEDIUM
Other records, highest priority first
- TI-2023-20441 OS command injection in QNAP QTSPriority MEDIUM 43
Timeline
- 2026-10-02 Threatist record created from CVE-2023-45025
- 2026-10-03 Alias added: GHSA-w4qh-vg3x-929v
References
More QNAP Qts vulnerabilities
- TI-2020-02221 Command Injection Vulnerability in QTS and QuTS hero KEVCVSS 3.1CRITICAL 9.8
- TI-2019-05101 Improper input validation in QNAP NAS devices KEVCVSS 3.1CRITICAL 9.8
- TI-2018-14137 Improper input validation in QNAP QTS KEVCVSS 3.1CRITICAL 9.8
- TI-2014-05975 GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed… KEVCVSS 3.1CRITICAL 9.8
- TI-2014-05157 GNU Bash through 4.3 processes trailing strings after function definitions in the values… KEVCVSS 3.1CRITICAL 9.8
- TI-2018-14131 Cross-site scripting in QNAP QTS KEVCVSS 3.1HIGH 8.0
Sources
- CVE-2023-45025 · CVE Program
- CVE-2023-45025 · NVD
- FIRST EPSS
- GHSA-w4qh-vg3x-929v · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences