Huasheng_Mangguo

**Name of the Vulnerable Software and Affected Versions** QTS versions prior to 4.5.4.2790 build 20240605 QuTS hero versions prior to h4.5.4.2626 build 20231225 **Description** An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow users to execute commands via a network. The issue is related to the failure to neutralize special elements used in the operating system command. **Recommendations** For QTS versions prior to 4.5.4.2790 build 20240605, update to version 4.5.4.2790 build 20240605 or later. For QuTS hero versions prior to h4.5.4.2626 build 20231225, update to version h4.5.4.2626 build 20231225 or later.

**Name of the Vulnerable Software and Affected Versions** QTS versions prior to 5.1.0.2444 build 20230629 QuTS hero versions prior to h5.1.0.2424 build 20230609 QuTScloud versions prior to c5.1.0.2498 **Description** A path traversal vulnerability has been reported, which could allow users to read the contents of unexpected files and expose sensitive data via a network. The issue is related to incorrect restriction of the directory path name with limited access. Exploitation of the vulnerability may allow a remote attacker to disclose protected information. **Recommendations** For QTS versions prior to 5.1.0.2444 build 20230629, update to QTS 5.1.0.2444 build 20230629 or later. For QuTS hero versions prior to h5.1.0.2424 build 20230609, update to QuTS hero h5.1.0.2424 build 20230609 or later. For QuTScloud versions prior to c5.1.0.2498, update to QuTScloud c5.1.0.2498 or later.

**Name of the Vulnerable Software and Affected Versions** QTS versions prior to 5.0.1.2277 QTS versions prior to 4.5.4.2280 build 20230112 QuTS hero versions prior to h5.0.1.2277 build 20230112 QuTS hero versions prior to h4.5.4.2374 build 20230417 QuTScloud versions prior to c5.0.1.2374 **Description** An uncontrolled resource consumption issue affects several QNAP operating system versions. If exploited, this could allow remote attackers to launch a denial-of-service (DoS) attack. **Recommendations** For QTS versions prior to 5.0.1.2277, update to version 5.0.1.2277 or later. For QTS versions prior to 4.5.4.2280 build 20230112, update to version 4.5.4.2280 build 20230112 or later. For QuTS hero versions prior to h5.0.1.2277 build 20230112, update to version h5.0.1.2277 build 20230112 or later. For QuTS hero versions prior to h4.5.4.2374 build 20230417, update to version h4.5.4.2374 build 20230417 or later. For QuTScloud versions prior to c5.0.1.2374, update to version c5.0.1.2374 or later.

**Name of the Vulnerable Software and Affected Versions** QuTS hero versions prior to h5.0.1.2248 build 20221215 QTS versions prior to 5.0.1.2234 build 20221201 **Description** A vulnerability has been reported to affect QNAP devices running QuTS hero and QTS, allowing remote attackers to inject malicious code. This issue is related to a SQL injection vulnerability. The vulnerability poses a threat to the confidentiality and integrity of the stored data. NAS devices are often targeted by ransomware due to the valuable data they store and their exposure to the Internet. **Recommendations** For QuTS hero versions prior to h5.0.1.2248 build 20221215, update to version h5.0.1.2248 build 20221215 or later. For QTS versions prior to 5.0.1.2234 build 20221201, update to version 5.0.1.2234 build 20221201 or later.