CVE-2023-34980: QTS, QuTS hero
An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated administrators to execute commands via a network.
We have already fixed the vulnerability in the following versions: QTS 4.5.4.2627 build 20231225 and later QuTS hero h4.5.4.2626 build 20231225 and later
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is the severity of CVE-2023-34980?
CVE-2023-34980 is considered to be a high severity OS command injection vulnerability.
How do I fix CVE-2023-34980?
To fix CVE-2023-34980, ensure that your QNAP operating system is updated to the latest version beyond 4.5.4.2627 for QTS or 4.5.4.2626 for QuTS hero.
Who is affected by CVE-2023-34980?
CVE-2023-34980 affects authenticated administrators of QNAP QTS and QuTS hero operating systems.
What are the potential consequences of exploiting CVE-2023-34980?
Exploiting CVE-2023-34980 could allow attackers to execute arbitrary commands on the affected QNAP systems.
Is there a temporary workaround for CVE-2023-34980?
Currently, the recommended approach is to update to the patched versions, as no temporary workaround is suggested for CVE-2023-34980.