PT-2024-2011 · Qnap · Qts+2

Published

2024-03-08

·

Updated

2024-03-13

·

CVE-2024-21900

CVSS v3.1

6.5

Medium

VectorAV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Name of the Vulnerable Software and Affected Versions QTS versions prior to 5.1.3.2578 build 20231110 QuTS hero versions prior to h5.1.3.2578 build 20231110 QuTScloud versions prior to c5.1.5.2651
Description An injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated users to execute commands via a network. The issue exists due to the lack of measures to neutralize special elements, which could allow a remote attacker to execute arbitrary commands.
Recommendations For QTS versions prior to 5.1.3.2578 build 20231110, update to QTS 5.1.3.2578 build 20231110 or later. For QuTS hero versions prior to h5.1.3.2578 build 20231110, update to QuTS hero h5.1.3.2578 build 20231110 or later. For QuTScloud versions prior to c5.1.5.2651, update to QuTScloud c5.1.5.2651 or later.

Fix

Special Elements Injection

Weakness Enumeration

CWE-74

Related Identifiers

BDU:2024-01872
CVE-2024-21900

Affected Products

Qts
Quts Hero
Qutscloud