CVE-2023-34979: QTS, QuTS hero

Published Sep 6, 2024

Updated

An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated administrators to execute commands via a network.

We have already fixed the vulnerability in the following versions: QTS 4.5.4.2790 build 20240605 and later QuTS hero h4.5.4.2790 build 20240606 and later

Affected Software

28 affected components

QNAP QTS=4.5.4.1715-build_20210630

QNAP QTS=4.5.4.1723-build_20210708

QNAP QTS=4.5.4.1741-build_20210726

QNAP QTS=4.5.4.1787-build_20210910

QNAP QTS=4.5.4.1800-build_20210923

QNAP QTS=4.5.4.1892-build_20211223

QNAP QTS=4.5.4.1931-build_20220128

QNAP QTS=4.5.4.2012-build_20220419

QNAP QTS=4.5.4.2117-build_20220802

QNAP QTS=4.5.4.2280-build_20230112

QNAP QTS=4.5.4.2374-build_20230416

QNAP QTS=4.5.4.2467-build_20230718

QNAP QTS=4.5.4.2627-build_20231225

QNAP QuTS hero=h4.5.4.1771-build_20210825

QNAP QuTS hero=h4.5.4.1800-build_20210923

QNAP QuTS hero=h4.5.4.1813-build_20211006

QNAP QuTS hero=h4.5.4.1848-build_20211109

QNAP QuTS hero=h4.5.4.1892-build_20211223

QNAP QuTS hero=h4.5.4.1951-build_20220218

QNAP QuTS hero=h4.5.4.1971-build_20220310

QNAP QuTS hero=h4.5.4.1991-build_20220330

QNAP QuTS hero=h4.5.4.2052-build_20220530

QNAP QuTS hero=h4.5.4.2138-build_20220824

QNAP QuTS hero=h4.5.4.2217-build_20221111

QNAP QuTS hero=h4.5.4.2272-build_20230105

QNAP QuTS hero=h4.5.4.2374-build_20230417

QNAP QuTS hero=h4.5.4.2476-build_20230728

QNAP QuTS hero=h4.5.4.2626-build_20231225

Remediation

Information

We have already fixed the vulnerability in the following versions: QTS 4.5.4.2790 build 20240605 and later QuTS hero h4.5.4.2790 build 20240606 and later

Event History

Sep 6, 2024

CVE Published

via MITRE·04:27 PM

Data Sourced

via MITRE·04:27 PM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·05:15 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2023-34979?

CVE-2023-34979 has a medium severity rating due to its potential impact on authenticated administrators.

How do I fix CVE-2023-34979?

To address CVE-2023-34979, update your QNAP devices to the latest version that fixes the vulnerability.

What systems are affected by CVE-2023-34979?

CVE-2023-34979 affects multiple versions of QNAP's QTS and QuTS hero operating systems.

Who is at risk from CVE-2023-34979?

Authenticated administrators using vulnerable QNAP versions are at risk of command execution via network.

What does CVE-2023-34979 allow an attacker to do?

CVE-2023-34979 allows an authenticated user to execute OS commands on the vulnerable QNAP systems.