CVE-2024-21900: QTS, QuTS hero, QuTScloud
An injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated users to execute commands via a network.
We have already fixed the vulnerability in the following versions: QTS 5.1.3.2578 build 20231110 and later QuTS hero h5.1.3.2578 build 20231110 and later QuTScloud c5.1.5.2651 and later
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is the severity of CVE-2024-21900?
CVE-2024-21900 is classified as a high severity vulnerability due to its potential to allow authenticated command execution.
How do I fix CVE-2024-21900?
To fix CVE-2024-21900, upgrade your QNAP operating system to at least version 5.1.3.2578 or the specified QuTS versions.
Which QNAP operating system versions are affected by CVE-2024-21900?
CVE-2024-21900 affects several versions of QNAP QTS, QuTS hero, and QuTScloud prior to the specified fixed versions.
Can CVE-2024-21900 be exploited remotely?
No, CVE-2024-21900 requires authentication, meaning it cannot be exploited remotely without valid user credentials.
What type of vulnerability is CVE-2024-21900?
CVE-2024-21900 is an injection vulnerability that allows authenticated users to execute arbitrary commands via a network.