CVE-2023-34974: QTS, QuTS hero, QuTScloud, QVR, QES

Published Sep 6, 2024

Updated

An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow users to execute commands via a network. QuTScloud, QVR, QES are not affected.

We have already fixed the vulnerability in the following versions: QTS 4.5.4.2790 build 20240605 and later QuTS hero h4.5.4.2626 build 20231225 and later

Affected Software

28 affected components

QNAP QTS=4.5.4.1715-build_20210630

QNAP QTS=4.5.4.1723-build_20210708

QNAP QTS=4.5.4.1741-build_20210726

QNAP QTS=4.5.4.1787-build_20210910

QNAP QTS=4.5.4.1800-build_20210923

QNAP QTS=4.5.4.1892-build_20211223

QNAP QTS=4.5.4.1931-build_20220128

QNAP QTS=4.5.4.2012-build_20220419

QNAP QTS=4.5.4.2117-build_20220802

QNAP QTS=4.5.4.2280-build_20230112

QNAP QTS=4.5.4.2374-build_20230416

QNAP QTS=4.5.4.2467-build_20230718

QNAP QTS=4.5.4.2627-build_20231225

QNAP QuTS hero=h4.5.4.1771-build_20210825

QNAP QuTS hero=h4.5.4.1800-build_20210923

QNAP QuTS hero=h4.5.4.1813-build_20211006

QNAP QuTS hero=h4.5.4.1848-build_20211109

QNAP QuTS hero=h4.5.4.1892-build_20211223

QNAP QuTS hero=h4.5.4.1951-build_20220218

QNAP QuTS hero=h4.5.4.1971-build_20220310

QNAP QuTS hero=h4.5.4.1991-build_20220330

QNAP QuTS hero=h4.5.4.2052-build_20220530

QNAP QuTS hero=h4.5.4.2138-build_20220824

QNAP QuTS hero=h4.5.4.2217-build_20221111

QNAP QuTS hero=h4.5.4.2272-build_20230105

QNAP QuTS hero=h4.5.4.2374-build_20230417

QNAP QuTS hero=h4.5.4.2476-build_20230728

QNAP QuTS hero=h4.5.4.2626-build_20231225

Remediation

Information

We have already fixed the vulnerability in the following versions: QTS 4.5.4.2790 build 20240605 and later QuTS hero h4.5.4.2626 build 20231225 and later

Event History

Sep 6, 2024

CVE Published

via MITRE·04:27 PM

Data Sourced

via MITRE·04:27 PM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·05:15 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2023-34974?

CVE-2023-34974 is categorized as a high severity vulnerability due to its potential for allowing OS command injection.

How do I fix CVE-2023-34974?

To fix CVE-2023-34974, update your QNAP operating system to the latest version that addresses this vulnerability.

Which QNAP software versions are affected by CVE-2023-34974?

CVE-2023-34974 affects specific versions of QNAP QTS and QUTS hero, particularly those between 4.5.4.1715 and 4.5.4.2627.

Can the exploitation of CVE-2023-34974 allow remote access?

Yes, exploitation of CVE-2023-34974 could allow attackers to execute commands on the affected QNAP devices via the network.

What should I do if my system is affected by CVE-2023-34974?

If your system is affected by CVE-2023-34974, immediately apply the security update provided by QNAP to mitigate the risk.