CVE-2023-34980

published 2024-03-08

CVE-2023-34980: An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow…

Priority P3 49 high 8.4 CVSS 3.1

AV N AC L PR H UI R S C C H I H A H

An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated administrators to execute commands via a network.

We have already fixed the vulnerability in the following versions:
QTS 4.5.4.2627 build 20231225 and later
QuTS hero h4.5.4.2626 build 20231225 and later

Affected

6 ranges

Vendor	Product	Version range	Fixed in
qnap	qts	—	—
qnap	qts	>= 4.5.1 < 4.5.4.2627	4.5.4.2627
qnap	quts_hero	—	—
qnap	quts_hero	>= h4.5.0 < h4.5.4.2626	h4.5.4.2626
qnap_systems_inc	qts	>= 4.5.x < 4.5.4.2627 build 20231225	4.5.4.2627 build 20231225
qnap_systems_inc	quts_hero	>= h4.5.x < h4.5.4.2626 build 20231225	h4.5.4.2626 build 20231225

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-78