CVE-2023-39297

CWE-78 — OS Command Injection3 documents3 sources

Severity

8.8HIGH

EPSS

0.3%

top 46.61%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Qnap Systems Inc. QTS Qnap Systems Inc. Quts Hero Qnap Systems Inc. Qutscloud +3 more

Timeline

PublishedFeb 2

Description

An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated users to execute commands via a network. We have already fixed the vulnerability in the following versions: QTS 5.1.4.2596 build 20231128 and later QTS 4.5.4.2627 build 20231225 and later QuTS hero h5.1.4.2596 build 20231128 and later QuTS hero h4.5.4.2626 build 20231225 and later QuTScloud c5.1.5.2651 and later

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 2.8 | Impact: 5.9

Affected Packages6 packages

▶CVEListV5qnap_systems_inc./quts_heroh5.1.x — h5.1.4.2596 build 20231128+1

▶CVEListV5qnap_systems_inc./qutscloudc5.x.x — c5.1.5.2651

▶NVDqnap/quts_hero23 versions+22

▶NVDqnap/qutscloudc5.1.0.2498

▶CVEListV5qnap_systems_inc./qts5.1.x — 5.1.4.2596 build 20231128+1

🔴Vulnerability Details

CVEList

QTS, QuTS hero, QuTScloud↗2024-02-02

▶

GHSA

GHSA-x96x-gwv6-4324: An OS command injection vulnerability has been reported to affect several QNAP operating system versions↗2024-02-02

▶