PT-2024-5949 · Qnap · Qts+1

Huasheng_Mangguo · Published 2024-09-06 · Updated 2024-09-13 · CVE-2023-34974

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions QTS versions prior to 4.5.4.2790 build 20240605 QuTS hero versions prior to h4.5.4.2626 build 20231225

Description An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow users to execute commands via a network. The issue is related to the failure to neutralize special elements used in the operating system command.

Recommendations For QTS versions prior to 4.5.4.2790 build 20240605, update to version 4.5.4.2790 build 20240605 or later. For QuTS hero versions prior to h4.5.4.2626 build 20231225, update to version h4.5.4.2626 build 20231225 or later.

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

BDU:2024-06756

CVE-2023-34974

Affected Products

Qts

Quts Hero

References · 9

• https://bdu.fstec.ru/vul/2024-06756 · Security Note
• https://qnap.com/en/security-advisory/qsa-24-32 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-34974 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-34974 · Security Note
• https://t.me/cvenotify/93768 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1832128048210035096 · Twitter Post
• https://twitter.com/CVEnew/status/1832097903185399899 · Twitter Post
• https://twitter.com/oktsec/status/1832135201289334960 · Twitter Post
• https://twitter.com/CveFindCom/status/1832102324182868477 · Twitter Post