PT-2023-25079 · Qnap · Qnap Qts+1

0X14Rev + 2 · Published 2023-10-13 · Updated 2026-01-12 · CVE-2023-34975

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions QNAP QuTS hero versions prior to h4.5.4.2626 build 20231225 QNAP QTS versions prior to 4.5.4.2627 build 20231225

Description An OS command injection issue has been reported, affecting several QNAP operating system versions. This could allow authenticated administrators to execute commands via a network.

Recommendations For QNAP QuTS hero versions prior to h4.5.4.2626 build 20231225, update to version h4.5.4.2626 build 20231225 or later. For QNAP QTS versions prior to 4.5.4.2627 build 20231225, update to version 4.5.4.2627 build 20231225 or later.

Fix

OS Command Injection

SQL injection

Weakness Enumeration

CWE-78

CWE-89

Related Identifiers

CVE-2023-34975

Affected Products

Qnap Qts

Qnap Quts Hero

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2023-34975 · Security Note
• https://osv.dev/vulnerability/CVE-2023-34975 · Vendor Advisory
• https://qnap.com/en/security-advisory/qsa-24-12 · Note
• https://t.me/cvenotify/73384 · Telegram Post
• https://t.me/cveNotify/148399 · Telegram Post