PT-2026-24596 · Qnap Systems+1 · Qts+1

CVE-2024-14026 · Publicado 2026-03-11 · Atualizado 2026-03-15

Positive Technologies (AI Summary)

CVSS v3.1

7.8

Alta

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions QNAP QTS versions prior to 5.1.9.2954 build 20241120 QNAP QTS versions prior to 5.2.3.3006 build 20250108 QNAP QuTS hero versions prior to h5.1.9.2954 build 20241120 QNAP QuTS hero versions prior to h5.2.3.3006 build 20250108

Description A command injection issue exists in QNAP operating systems. An attacker with local network access and a user account can exploit this to execute arbitrary commands.

Recommendations Update QTS to version 5.1.9.2954 build 20241120 or later. Update QTS to version 5.2.3.3006 build 20250108 or later. Update QuTS hero to version h5.1.9.2954 build 20241120 or later. Update QuTS hero to version h5.2.3.3006 build 20250108 or later.

Correção

OS Command Injection

Enumeração de Fraquezas

CWE-78

Identificadores relacionados

CVE-2024-14026

Produtos afetados

Qts

Quts Hero

Referências · 9

• https://nvd.nist.gov/vuln/detail/CVE-2024-14026 · Nota de Segurança
• https://qnap.com/en/security-advisory/qsa-24-57 · Nota
• https://t.me/CVEtracker/47111 · Publicação no Telegram
• https://qnap.com/en/security-advisory/qsa-24-54 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2024-14026 · Aviso do Fabricante
• https://twitter.com/CVEnew/status/2033194309382701385 · Publicação no Twitter
• https://t.me/cveNotify/155060 · Publicação no Telegram
• https://t.me/cveNotify/155066 · Publicação no Telegram
• https://t.me/cveNotify/155367 · Publicação no Telegram