⚠ Exploited in the wild
Exploitation observed in the wild. Not yet on CISA KEV.

CVE-2023-47218

CWE-77 — Command InjectionCWE-78 — OS Command Injection6 documents6 sources
Severity
8.3HIGH
EPSS
93.2%
top 0.20%
CISA KEV
Not in KEV
Exploit
Exploited in wild
Active exploitation observed
Affected products
6
Qnap Systems Inc. QTSQnap Systems Inc. Quts HeroQnap Systems Inc. Qutscloud+3 more
Timeline
PublishedFeb 13

Description

An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow users to execute commands via a network. We have already fixed the vulnerability in the following versions: QTS 5.1.5.2645 build 20240116 and later QuTS hero h5.1.5.2647 build 20240118 and later QuTScloud c5.1.5.2651 and later

CVSS vector

CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:LExploitability: 1.6 | Impact: 3.7

Affected Packages6 packages

▶CVEListV5qnap_systems_inc./quts_heroh5.1.x — h5.1.5.2647 build 20240118
▶CVEListV5qnap_systems_inc./qutscloudc5.x — c5.1.5.2651
▶NVDqnap/quts_heroh5.1.0 — h5.1.5.2647+1
▶NVDqnap/qutscloudc5.0.0.1919 — c5.1.5.2651
▶CVEListV5qnap_systems_inc./qts5.1.x — 5.1.5.2645 build 20240116

🔴Vulnerability Details

3
CVEList
QTS, QuTS hero, QuTScloud↗2024-02-13
▶
GHSA
GHSA-j269-5p85-wxpq: An OS command injection vulnerability has been reported to affect several QNAP operating system versions↗2024-02-13
▶
VulnCheck
QNAP QTS and QuTS Command Injection Vulnerability↗2023
▶

💥Exploits & PoCs

1
Nuclei
QNAP QTS and QuTS Hero - OS Command Injection
▶

🔍Detection Rules

1
Suricata
ET WEB_SPECIFIC_APPS QNAP quick.cgi uploaf_firmware_image Command Injection Attempt (CVE-2023-47218)↗2024-02-13
▶
CVE-2023-47218 (HIGH CVSS 8.3) | An OS command injection vulnerabili | cvebase.io