CVE-2023-45025: QTS, QuTS hero, QuTScloud

Published Feb 2, 2024

Updated

An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow users to execute commands via a network.

We have already fixed the vulnerability in the following versions: QTS 5.1.4.2596 build 20231128 and later QTS 4.5.4.2627 build 20231225 and later QuTS hero h5.1.4.2596 build 20231128 and later QuTS hero h4.5.4.2626 build 20231225 and later QuTScloud c5.1.5.2651 and later

Affected Software

45 affected components

QNAP QTS=4.5.4.1715-build_20210630

QNAP QTS=4.5.4.1723-build_20210708

QNAP QTS=4.5.4.1741-build_20210726

QNAP QTS=4.5.4.1787-build_20210910

QNAP QTS=4.5.4.1800-build_20210923

QNAP QTS=4.5.4.1892-build_20211223

QNAP QTS=4.5.4.1931-build_20220128

QNAP QTS=4.5.4.2012-build_20220419

QNAP QTS=4.5.4.2117-build_20220802

QNAP QTS=4.5.4.2280-build_20230112

QNAP QTS=4.5.4.2374-build_20230416

QNAP QTS=4.5.4.2627

QNAP QTS=5.1.0.2348-build_20230325

QNAP QTS=5.1.0.2399-build_20230515

QNAP QTS=5.1.0.2418-build_20230603

QNAP QTS=5.1.0.2444-build_20230629

QNAP QTS=5.1.0.2466-build_20230721

QNAP QTS=5.1.1.2491-build_20230815

QNAP QTS=5.1.2.2533-build_20230926

QNAP QTS=5.1.3.2578-build_20231110

QNAP QTS=5.1.4.2596

QNAP QuTS hero=h4.5.4.1771-build_20210825

QNAP QuTS hero=h4.5.4.1800-build_20210923

QNAP QuTS hero=h4.5.4.1813-build_20211006

QNAP QuTS hero=h4.5.4.1848-build_20211109

QNAP QuTS hero=h4.5.4.1892-build_20211223

QNAP QuTS hero=h4.5.4.1951-build_20220218

QNAP QuTS hero=h4.5.4.1971-build_20220310

QNAP QuTS hero=h4.5.4.1991-build_20220330

QNAP QuTS hero=h4.5.4.2052-build_20220530

QNAP QuTS hero=h4.5.4.2138-build_20220824

QNAP QuTS hero=h4.5.4.2217-build_20221111

QNAP QuTS hero=h4.5.4.2272-build_20230105

QNAP QuTS hero=h4.5.4.2374-build_20230417

QNAP QuTS hero=h4.5.4.2476-build_20230728

QNAP QuTS hero=h4.5.4.2626

QNAP QuTS hero=h5.1.0.2409-build_20230525

QNAP QuTS hero=h5.1.0.2424-build_20230609

QNAP QuTS hero=h5.1.0.2453-build_20230708

QNAP QuTS hero=h5.1.0.2466-build_20230721

QNAP QuTS hero=h5.1.1.2488-build_20230812

QNAP QuTS hero=h5.1.2.2534-build_20230927

QNAP QuTS hero=h5.1.3.2578-build_20231110

QNAP QuTS hero=h5.1.4.2596

QNAP QuTScloud=c5.1.0.2498-build_20230822

Remediation

Information

Event History

Feb 2, 2024

CVE Published

via MITRE·04:05 PM

Data Sourced

via MITRE·04:05 PM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·04:15 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2023-45025?

CVE-2023-45025 has been classified as a critical severity OS command injection vulnerability affecting several QNAP OS versions.

How do I fix CVE-2023-45025?

To fix CVE-2023-45025, update your QNAP system to version 5.1.4.2596 or later.

Which QNAP versions are affected by CVE-2023-45025?

CVE-2023-45025 affects multiple QNAP QTS versions, including 4.5.4.1715 to 4.5.4.2374 and 5.1.0.2348 to 5.1.4.2596.

What could happen if CVE-2023-45025 is exploited?

If exploited, CVE-2023-45025 may allow an attacker to execute arbitrary OS commands through a network.

How can I determine if my QNAP system is vulnerable to CVE-2023-45025?

You can determine if your system is vulnerable by checking if it is operating on any of the affected versions outlined for CVE-2023-45025.