Read the docs
TI-2023-27546 Aliases CVE-2023-50358GHSA-975j-m6j8-qh4v

OS command injection in QNAP QTS

Priority MEDIUM 41CWE-78Published · Updated

Key facts

Attack vector
Adjacent network
Privileges required
None
User interaction
None
Attack complexity
High
Impact type
Code execution
Confidentiality · integrity · availability
Low · Low · Low
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-78.

Summary

An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow users to execute commands via a network. We have already fixed the vulnerability in the following versions: QTS 5.1.5.2645 build 20240116 and later QTS 4.5.4.2627 build 20231225 and later QTS 4.3.6.2665 build 20240131 and later QTS 4.3.4.2675 build 20240131 and later QTS 4.3.3.2644 build 20240131 and later QTS 4.2.6 build 20240131 and later QuTS hero h5.1.5.2647 build 20240118 and later QuTS hero h4.5.4.2626 build 20231225 and later QuTScloud c5.1.5.2651 and later

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.13523 96th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed QTS (QNAP Systems Inc.): 5.1.5.2645 build 20240116, 4.5.4.2627 build 20231225, 4.3.6.2665 build 20240131 +3QuTS hero (QNAP Systems Inc.): h5.1.5.2647 build 20240118, h4.5.4.2626 build 20231225+1 more product

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
QNAPQTS5.x to before 5.1.5.2645 build 20240116; 4.5.x, 4.4.x to before 4.5.4.2627 build 20231225; 4.3.6, 4.3.5 to before 4.3.6.2665 build 20240131; 4.3.4 to before 4.3.4.2675 build 20240131; 4.3.x to before 4.3.3.2644 build 20240131; 4.2.x to before 4.2.6 build 202401315.1.5.2645 build 20240116, 4.5.4.2627 build 20231225, 4.3.6.2665 build 20240131, 4.3.4.2675 build 20240131, 4.3.3.2644 build 20240131, 4.2.6 build 20240131Patch availableCNA
QNAPQuTS heroh5.x to before h5.1.5.2647 build 20240118; h4.x to before h4.5.4.2626 build 20231225h5.1.5.2647 build 20240118, h4.5.4.2626 build 20231225Patch availableCNA
QNAPQuTScloudc5.x to before c5.1.5.2651c5.1.5.2651Patch availableCNA
  • QTS VendorQNAP Affected 5.x to before 5.1.5.2645 build 20240116; 4.5.x, 4.4.x to before 4.5.4.2627 build 20231225; 4.3.6, 4.3.5 to before 4.3.6.2665 build 20240131; 4.3.4 to before 4.3.4.2675 build 20240131; 4.3.x to before 4.3.3.2644 build 20240131; 4.2.x to before 4.2.6 build 20240131 Fixed in 5.1.5.2645 build 20240116, 4.5.4.2627 build 20231225, 4.3.6.2665 build 20240131, 4.3.4.2675 build 20240131, 4.3.3.2644 build 20240131, 4.2.6 build 20240131 Patch available CNA
  • QuTS hero VendorQNAP Affected h5.x to before h5.1.5.2647 build 20240118; h4.x to before h4.5.4.2626 build 20231225 Fixed in h5.1.5.2647 build 20240118, h4.5.4.2626 build 20231225 Patch available CNA
  • QuTScloud VendorQNAP Affected c5.x to before c5.1.5.2651 Fixed in c5.1.5.2651 Patch available CNA

CPE configurations NVD · 23

CPEVersionsRoleVendor
cpe:2.3:o:qnap:qts:*:*:*:*:*:*:*:*4.2.0 to before 4.2.6; 4.3.0 to before 4.3.3.2644; 4.3.4 to before 4.3.4.2675; 4.3.5 to before 4.3.6.2665; 4.5.1 to before 4.5.4.2627; 5.1.0 to before 5.1.5.2645VulnerableQNAP
cpe:2.3:o:qnap:qts:4.2.6:-:*:*:*:*:*:*4.2.6VulnerableQNAP
cpe:2.3:o:qnap:qts:4.2.6:build_20170517:*:*:*:*:*:*4.2.6 build_20170517VulnerableQNAP
cpe:2.3:o:qnap:qts:4.2.6:build_20190322:*:*:*:*:*:*4.2.6 build_20190322VulnerableQNAP
cpe:2.3:o:qnap:qts:4.2.6:build_20190730:*:*:*:*:*:*4.2.6 build_20190730VulnerableQNAP
cpe:2.3:o:qnap:qts:4.2.6:build_20190921:*:*:*:*:*:*4.2.6 build_20190921VulnerableQNAP
cpe:2.3:o:qnap:qts:4.2.6:build_20191107:*:*:*:*:*:*4.2.6 build_20191107VulnerableQNAP
cpe:2.3:o:qnap:qts:4.2.6:build_20200109:*:*:*:*:*:*4.2.6 build_20200109VulnerableQNAP
cpe:2.3:o:qnap:qts:4.2.6:build_20200421:*:*:*:*:*:*4.2.6 build_20200421VulnerableQNAP
cpe:2.3:o:qnap:qts:4.2.6:build_20200611:*:*:*:*:*:*4.2.6 build_20200611VulnerableQNAP
  • cpe:2.3:o:qnap:qts:*:*:*:*:*:*:*:* Versions 4.2.0 to before 4.2.6; 4.3.0 to before 4.3.3.2644; 4.3.4 to before 4.3.4.2675; 4.3.5 to before 4.3.6.2665; 4.5.1 to before 4.5.4.2627; 5.1.0 to before 5.1.5.2645 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.2.6:-:*:*:*:*:*:* Versions 4.2.6 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.2.6:build_20170517:*:*:*:*:*:* Versions 4.2.6 build_20170517 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.2.6:build_20190322:*:*:*:*:*:* Versions 4.2.6 build_20190322 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.2.6:build_20190730:*:*:*:*:*:* Versions 4.2.6 build_20190730 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.2.6:build_20190921:*:*:*:*:*:* Versions 4.2.6 build_20190921 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.2.6:build_20191107:*:*:*:*:*:* Versions 4.2.6 build_20191107 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.2.6:build_20200109:*:*:*:*:*:* Versions 4.2.6 build_20200109 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.2.6:build_20200421:*:*:*:*:*:* Versions 4.2.6 build_20200421 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.2.6:build_20200611:*:*:*:*:*:* Versions 4.2.6 build_20200611 Vulnerable ·QNAP
Show 13 more CPE
CPEVersionsRoleVendor
cpe:2.3:o:qnap:qts:4.2.6:build_20200821:*:*:*:*:*:*4.2.6 build_20200821VulnerableQNAP
cpe:2.3:o:qnap:qts:4.2.6:build_20210327:*:*:*:*:*:*4.2.6 build_20210327VulnerableQNAP
cpe:2.3:o:qnap:qts:4.2.6:build_20211215:*:*:*:*:*:*4.2.6 build_20211215VulnerableQNAP
cpe:2.3:o:qnap:qts:4.2.6:build_20220304:*:*:*:*:*:*4.2.6 build_20220304VulnerableQNAP
cpe:2.3:o:qnap:qts:4.2.6:build_20220623:*:*:*:*:*:*4.2.6 build_20220623VulnerableQNAP
cpe:2.3:o:qnap:qts:4.2.6:build_20221028:*:*:*:*:*:*4.2.6 build_20221028VulnerableQNAP
cpe:2.3:o:qnap:qts:4.2.6:build_20230621:*:*:*:*:*:*4.2.6 build_20230621VulnerableQNAP
cpe:2.3:o:qnap:qts:4.5.4.2627:-:*:*:*:*:*:*4.5.4.2627VulnerableQNAP
cpe:2.3:o:qnap:qts:5.1.5.2645:-:*:*:*:*:*:*5.1.5.2645VulnerableQNAP
cpe:2.3:o:qnap:quts_hero:*:*:*:*:*:*:*:*h4.5.0 to before h4.5.4.2626; h5.0.0 to before h5.1.5.2647VulnerableQNAP
cpe:2.3:o:qnap:quts_hero:h4.5.4.2626:-:*:*:*:*:*:*h4.5.4.2626VulnerableQNAP
cpe:2.3:o:qnap:quts_hero:h5.1.5.2647:-:*:*:*:*:*:*h5.1.5.2647VulnerableQNAP
cpe:2.3:o:qnap:qutscloud:*:*:*:*:*:*:*:*c5.0.0.1919 to before c5.1.5.2651VulnerableQNAP
  • cpe:2.3:o:qnap:qts:4.2.6:build_20200821:*:*:*:*:*:* Versions 4.2.6 build_20200821 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.2.6:build_20210327:*:*:*:*:*:* Versions 4.2.6 build_20210327 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.2.6:build_20211215:*:*:*:*:*:* Versions 4.2.6 build_20211215 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.2.6:build_20220304:*:*:*:*:*:* Versions 4.2.6 build_20220304 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.2.6:build_20220623:*:*:*:*:*:* Versions 4.2.6 build_20220623 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.2.6:build_20221028:*:*:*:*:*:* Versions 4.2.6 build_20221028 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.2.6:build_20230621:*:*:*:*:*:* Versions 4.2.6 build_20230621 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.5.4.2627:-:*:*:*:*:*:* Versions 4.5.4.2627 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:5.1.5.2645:-:*:*:*:*:*:* Versions 5.1.5.2645 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:quts_hero:*:*:*:*:*:*:*:* Versions h4.5.0 to before h4.5.4.2626; h5.0.0 to before h5.1.5.2647 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:quts_hero:h4.5.4.2626:-:*:*:*:*:*:* Versions h4.5.4.2626 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:quts_hero:h5.1.5.2647:-:*:*:*:*:*:* Versions h5.1.5.2647 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qutscloud:*:*:*:*:*:*:*:* Versions c5.0.0.1919 to before c5.1.5.2651 Vulnerable ·QNAP

Remediation

  • Fix · CNA QTS (QNAP Systems Inc.) Fixed in 5.1.5.2645 build 20240116, 4.5.4.2627 build 20231225, 4.3.6.2665 build 20240131, 4.3.4.2675 build 20240131, 4.3.3.2644 build 20240131, 4.2.6 build 20240131
  • Fix · CNA QuTS hero (QNAP Systems Inc.) Fixed in h5.1.5.2647 build 20240118, h4.5.4.2626 build 20231225
  • Fix · CNA QuTScloud (QNAP Systems Inc.) Fixed in c5.1.5.2651

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    QNAP Systems QuTScloud c5.1.5.2651

    2 records Highest priority Priority HIGH 1 HIGH, 1 MEDIUM

    Other records, highest priority first

    Show all 2 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-50358
  2. 2026-10-03 Alias added: GHSA-975j-m6j8-qh4v

References

Exploit 1

Advisory 2

  • TI-2020-02221 Command Injection Vulnerability in QTS and QuTS hero KEVCVSS 3.1CRITICAL 9.8
  • TI-2019-05101 Improper input validation in QNAP NAS devices KEVCVSS 3.1CRITICAL 9.8
  • TI-2018-14137 Improper input validation in QNAP QTS KEVCVSS 3.1CRITICAL 9.8
  • TI-2014-05975 GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed… KEVCVSS 3.1CRITICAL 9.8
  • TI-2014-05157 GNU Bash through 4.3 processes trailing strings after function definitions in the values… KEVCVSS 3.1CRITICAL 9.8
  • TI-2018-14131 Cross-site scripting in QNAP QTS KEVCVSS 3.1HIGH 8.0
See all 282 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences