Description
An OS command injection vulnerability has been reported to affect legacy QTS. If exploited, the vulnerability could allow authenticated administrators to execute commands via a network. We have already fixed the vulnerability in the following versions: QTS 4.3.6.2805 build 20240619 and later QTS 4.3.4.2814 build 20240618 and later QTS 4.3.3.2784 build 20240619 and later QTS 4.2.6 build 20240618 and later
CVSS breakdown
CVSS 3.1
Attack Vector
Network
Attack Complexity
Low
Privileges Required
High
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Affected products
- QNAP Systems Inc. / QTS4.3.6 – 4.3.6.2805 build 20240619
- QNAP Systems Inc. / QTS4.3.4 – 4.3.4.2814 build 20240618
- QNAP Systems Inc. / QTS4.3.3 – 4.3.3.2784 build 20240619
- QNAP Systems Inc. / QTS4.2.6 – 4.2.6 build 20240618
- QNAP Systems Inc. / QTS5.x – 5.x
- QNAP Systems Inc. / QTS4.5.x – 4.5.x
- QNAP Systems Inc. / QuTScloudc5.x – c5.x
- QNAP Systems Inc. / QuTS heroh5.x – h5.x
- QNAP Systems Inc. / QuTS heroh4.5.x – h4.5.x