CVE-2023-50358: QTS, QuTS hero, QuTScloud

Q: What is the severity of CVE-2023-50358?

CVE-2023-50358 is considered to have a high severity due to its potential for OS command injection.

Q: How do I fix CVE-2023-50358?

To fix CVE-2023-50358, update your QTS operating system to version 5.1.5.2645 or later.

Q: Which QNAP operating system versions are affected by CVE-2023-50358?

CVE-2023-50358 affects several QNAP operating system versions prior to the patched 5.1.5.2645 build.

Q: What could happen if CVE-2023-50358 is exploited?

If exploited, CVE-2023-50358 could allow unauthorized users to execute OS commands through the network.

Q: Is there a workaround for CVE-2023-50358?

There are no reliable workarounds for CVE-2023-50358; the best course of action is to apply the software update.

Published Feb 13, 2024

Updated

An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow users to execute commands via a network.

We have already fixed the vulnerability in the following versions: QTS 5.1.5.2645 build 20240116 and later QTS 4.5.4.2627 build 20231225 and later QTS 4.3.6.2665 build 20240131 and later QTS 4.3.4.2675 build 20240131 and later QTS 4.3.3.2644 build 20240131 and later QTS 4.2.6 build 20240131 and later QuTS hero h5.1.5.2647 build 20240118 and later QuTS hero h4.5.4.2626 build 20231225 and later QuTScloud c5.1.5.2651 and later

Affected Software

30 affected components

QNAP QTS

QNAP QTS>=4.2.0<4.2.6

QNAP QTS>=4.3.0<4.3.3.2644

QNAP QTS>=4.3.4<4.3.4.2675

QNAP QTS>=4.3.5<4.3.6.2665

QNAP QTS>=4.5.1<4.5.4.2627

QNAP QTS>=5.1.0<5.1.5.2645

QNAP QTS=4.2.6

QNAP QTS=4.2.6-build_20170517

QNAP QTS=4.2.6-build_20190322

QNAP QTS=4.2.6-build_20190730

QNAP QTS=4.2.6-build_20190921

QNAP QTS=4.2.6-build_20191107

QNAP QTS=4.2.6-build_20200109

QNAP QTS=4.2.6-build_20200421

QNAP QTS=4.2.6-build_20200611

QNAP QTS=4.2.6-build_20200821

QNAP QTS=4.2.6-build_20210327

QNAP QTS=4.2.6-build_20211215

QNAP QTS=4.2.6-build_20220304

QNAP QTS=4.2.6-build_20220623

QNAP QTS=4.2.6-build_20221028

QNAP QTS=4.2.6-build_20230621

QNAP QTS=4.5.4.2627

QNAP QTS=5.1.5.2645

QNAP QuTS hero>=h4.5.0<h4.5.4.2626

QNAP QuTS hero>=h5.0.0<h5.1.5.2647

QNAP QuTS hero=h4.5.4.2626

QNAP QuTS hero=h5.1.5.2647

QNAP QuTScloud>=c5.0.0.1919<c5.1.5.2651

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade QNAP QTS to a version that resolves this vulnerability.
Fixed in 4.2.6 build 20240131
Upgrade
Upgrade QNAP QTS to a version that resolves this vulnerability.
Fixed in 4.3.3.2644 build 20240131
Upgrade
Upgrade QNAP QTS to a version that resolves this vulnerability.
Fixed in 4.3.4.2675 build 20240131
Upgrade
Upgrade QNAP QTS to a version that resolves this vulnerability.
Fixed in 4.3.6.2665 build 20240131
Upgrade
Upgrade QNAP QTS to a version that resolves this vulnerability.
Fixed in 4.5.4.2627 build 20231225
Upgrade
Upgrade QNAP QTS to a version that resolves this vulnerability.
Fixed in 5.1.5.2645 build 20240116
Upgrade
Upgrade QNAP QuTS hero to a version that resolves this vulnerability.
Fixed in h4.5.4.2626 build 20231225
Upgrade
Upgrade QNAP QuTS hero to a version that resolves this vulnerability.
Fixed in h5.1.5.2647 build 20240118
Upgrade
Upgrade QNAP QuTScloud to a version that resolves this vulnerability.
Fixed in c5.1.5.2651

Event History

Feb 13, 2024

CVE Published

via MITRE·02:45 AM

Data Sourced

via MITRE·02:45 AM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·03:15 AM

DescriptionSeverityWeaknessAffected Software

News Published

via The Register·08:00 PM

May 20, 2024

News Published

via The Register·02:00 PM

Peer vulnerabilities

Found alongside the following vulnerabilities.

CVE-2023-47218

Frequently Asked Questions

What is the severity of CVE-2023-50358?

CVE-2023-50358 is considered to have a high severity due to its potential for OS command injection.

How do I fix CVE-2023-50358?