CVE-2023-47218: QTS, QuTS hero, QuTScloud

Q: What is the severity of CVE-2023-47218?

CVE-2023-47218 is classified as a high severity OS command injection vulnerability.

Q: How do I fix CVE-2023-47218?

To fix CVE-2023-47218, upgrade your QNAP device to QTS 5.1.5.2645 or newer.

Q: Which QNAP products are affected by CVE-2023-47218?

CVE-2023-47218 affects several versions of the QNAP QTS operating system.

Q: What could an attacker achieve by exploiting CVE-2023-47218?

Exploiting CVE-2023-47218 could allow attackers to execute arbitrary commands over the network.

Q: Is there a patch available for CVE-2023-47218?

Yes, a patch has been released in QTS version 5.1.5.2645 and later for CVE-2023-47218.

Published Feb 13, 2024

Updated

An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow users to execute commands via a network.

We have already fixed the vulnerability in the following versions: QTS 5.1.5.2645 build 20240116 and later QuTS hero h5.1.5.2647 build 20240118 and later QuTScloud c5.1.5.2651 and later

Affected Software

6 affected components

QNAP QTS

QNAP QTS>=5.1.0<5.1.5.2645

QNAP QTS=5.1.5.2645

QNAP QuTS hero>=h5.1.0<h5.1.5.2647

QNAP QuTS hero=h5.1.5.2647

QNAP QuTScloud>=c5.0.0.1919<c5.1.5.2651

Remediation

Information

We have already fixed the vulnerability in the following versions: QTS 5.1.5.2645 build 20240116 and later QuTS hero h5.1.5.2647 build 20240118 and later QuTScloud c5.1.5.2651 and later

Event History

Feb 13, 2024

CVE Published

via MITRE·02:44 AM

Data Sourced

via MITRE·02:44 AM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·03:15 AM

DescriptionSeverityWeaknessAffected Software

News Published

via The Register·08:00 PM

News Published

via The Register·08:04 PM

Peer vulnerabilities

Found alongside the following vulnerabilities.

CVE-2023-50358

Frequently Asked Questions

What is the severity of CVE-2023-47218?