CVE-2023-39294: QTS, QuTS hero

Published Jan 5, 2024

Updated

An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated administrators to execute commands via a network.

We have already fixed the vulnerability in the following versions: QTS 5.1.3.2578 build 20231110 and later QuTS hero h5.1.3.2578 build 20231110 and later

Affected Software

13 affected components

QNAP QTS=5.1.0.2348-build_20230325

QNAP QTS=5.1.0.2399-build_20230515

QNAP QTS=5.1.0.2418-build_20230603

QNAP QTS=5.1.0.2444-build_20230629

QNAP QTS=5.1.0.2466-build_20230721

QNAP QTS=5.1.1.2491-build_20230815

QNAP QTS=5.1.2.2533-build_20230926

QNAP QuTS hero=h5.1.0.2409-build_20230525

QNAP QuTS hero=h5.1.0.2424-build_20230609

QNAP QuTS hero=h5.1.0.2453-build_20230708

QNAP QuTS hero=h5.1.0.2466-build_20230721

QNAP QuTS hero=h5.1.1.2488-build_20230812

QNAP QuTS hero=h5.1.2.2534-build_20230927

Remediation

Information

We have already fixed the vulnerability in the following versions: QTS 5.1.3.2578 build 20231110 and later QuTS hero h5.1.3.2578 build 20231110 and later

Event History

Jan 5, 2024

CVE Published

via MITRE·04:19 PM

Data Sourced

via MITRE·04:19 PM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·05:15 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2023-39294?

The severity of CVE-2023-39294 is considered high due to its potential for exploitation through OS command injection.

How do I fix CVE-2023-39294?

To fix CVE-2023-39294, update your QNAP operating system to one of the patched versions listed in the security advisory.

Which QNAP versions are affected by CVE-2023-39294?

CVE-2023-39294 affects several versions of QNAP QTS and QuTS hero including versions prior to their respective latest updates mentioned in the advisory.

Can unauthenticated users exploit CVE-2023-39294?

No, CVE-2023-39294 requires authentication as an administrator for exploitation.

What types of attacks can CVE-2023-39294 enable?

CVE-2023-39294 can enable authenticated attackers to execute arbitrary OS commands via the network.