CVE-2023-39300: QTS

Published Sep 6, 2024
·
Updated

An OS command injection vulnerability has been reported to affect legacy QTS. If exploited, the vulnerability could allow authenticated administrators to execute commands via a network.

We have already fixed the vulnerability in the following versions: QTS 4.3.6.2805 build 20240619 and later QTS 4.3.4.2814 build 20240618 and later QTS 4.3.3.2784 build 20240619 and later QTS 4.2.6 build 20240618 and later

Affected Software

79 affected components
QNAP QTS=4.3.6.0895-build_20190328
QNAP QTS=4.3.6.0907-build_20190409
QNAP QTS=4.3.6.0923-build_20190425
QNAP QTS=4.3.6.0944-build_20190516
QNAP QTS=4.3.6.0959-build_20190531
QNAP QTS=4.3.6.0979-build_20190620
QNAP QTS=4.3.6.0993-build_20190704
QNAP QTS=4.3.6.1013-build_20190724
QNAP QTS=4.3.6.1033-build_20190813
QNAP QTS=4.3.6.1070-build_20190919
QNAP QTS=4.3.6.1154-build_20191212
QNAP QTS=4.3.6.1218-build_20200214
QNAP QTS=4.3.6.1263-build_20200330
QNAP QTS=4.3.6.1286-build_20200422
QNAP QTS=4.3.6.1333-build_20200608
QNAP QTS=4.3.6.1411-build_20200825
QNAP QTS=4.3.6.1446-build_20200929
QNAP QTS=4.3.6.1620-build_20210322
QNAP QTS=4.3.6.1663-build_20210504
QNAP QTS=4.3.6.1711-build_20210621
QNAP QTS=4.3.6.1750-build_20210730
QNAP QTS=4.3.6.1831-build_20211019
QNAP QTS=4.3.6.1907-build_20220103
QNAP QTS=4.3.6.1965-build_20220302
QNAP QTS=4.3.6.2050-build_20220526
QNAP QTS=4.3.6.2232-build_20221124
QNAP QTS=4.3.6.2441-build_20230621
QNAP QTS=4.3.6.2665-build_20240131
QNAP QTS=4.3.4.0899-build_20190322
QNAP QTS=4.3.4.1029-build_20190730
QNAP QTS=4.3.4.1082-build_20190921
QNAP QTS=4.3.4.1190-build_20200107
QNAP QTS=4.3.4.1282-build_20200408
QNAP QTS=4.3.4.1368-build_20200703
QNAP QTS=4.3.4.1417-build_20200821
QNAP QTS=4.3.4.1463-build_20201006
QNAP QTS=4.3.4.1632-build_20210324
QNAP QTS=4.3.4.1652-build_20210413
QNAP QTS=4.3.4.1976-build_20220303
QNAP QTS=4.3.4.2107-build_20220712
QNAP QTS=4.3.4.2242-build_20221124
QNAP QTS=4.3.4.2451-build_20230621
QNAP QTS=4.3.4.2675-build_20240131
QNAP QTS=4.3.3.0174-build_20170503
QNAP QTS=4.3.3.0868-build_20190322
QNAP QTS=4.3.3.0998-build_20190730
QNAP QTS=4.3.3.1051-build_20190921
QNAP QTS=4.3.3.1098-build_20191107
QNAP QTS=4.3.3.1161-build_20200109
QNAP QTS=4.3.3.1252-build_20200409
QNAP QTS=4.3.3.1315-build_20200611
QNAP QTS=4.3.3.1386-build_20200821
QNAP QTS=4.3.3.1432-build_20201006
QNAP QTS=4.3.3.1624-build_20210416
QNAP QTS=4.3.3.1677-build_20210608
QNAP QTS=4.3.3.1693-build_20210624
QNAP QTS=4.3.3.1799-build_20211008
QNAP QTS=4.3.3.1864-build_20211212
QNAP QTS=4.3.3.1945-build_20220303
QNAP QTS=4.3.3.2057-build_20220623
QNAP QTS=4.3.3.2211-build_20221124
QNAP QTS=4.3.3.2420-build_20230621
QNAP QTS=4.3.3.2644-build_20240131
QNAP QTS=4.2.6-build_20170517
QNAP QTS=4.2.6-build_20190322
QNAP QTS=4.2.6-build_20190730
QNAP QTS=4.2.6-build_20190921
QNAP QTS=4.2.6-build_20191107
QNAP QTS=4.2.6-build_20200109
QNAP QTS=4.2.6-build_20200421
QNAP QTS=4.2.6-build_20200611
QNAP QTS=4.2.6-build_20200821
QNAP QTS=4.2.6-build_20210327
QNAP QTS=4.2.6-build_20211215
QNAP QTS=4.2.6-build_20220304
QNAP QTS=4.2.6-build_20220623
QNAP QTS=4.2.6-build_20221028
QNAP QTS=4.2.6-build_20230621
QNAP QTS=4.2.6-build_20240131

Remediation

Information

We have already fixed the vulnerability in the following versions: QTS 4.3.6.2805 build 20240619 and later QTS 4.3.4.2814 build 20240618 and later QTS 4.3.3.2784 build 20240619 and later QTS 4.2.6 build 20240618 and later

Event History

Sep 6, 2024
CVE Published
via MITRE·04:27 PM
Data Sourced
via MITRE·04:27 PM
RemedyDescriptionSeverityWeakness
Data Sourced
via NVD·05:15 PM
DescriptionSeverityWeakness

Frequently Asked Questions

1

What is the severity of CVE-2023-39300?

CVE-2023-39300 is classified as a critical vulnerability due to its potential for OS command injection by authenticated administrators.

2

How do I fix CVE-2023-39300?

To fix CVE-2023-39300, update your QTS to version 4.3.6.2805 or later.

3

What versions are affected by CVE-2023-39300?

CVE-2023-39300 affects multiple builds of QNAP's QTS 4.3.6 and some versions of QTS 4.3.x.

4

Can CVE-2023-39300 be exploited remotely?

Yes, CVE-2023-39300 can be exploited remotely if the attacker has authenticated access as an administrator.

5

Is there a workaround for CVE-2023-39300?

There is no official workaround for CVE-2023-39300; upgrading to a patched version is the recommended and only solution.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203