CVE-2024-50393: QTS, QuTS hero

Q: What is the severity of CVE-2024-50393?

CVE-2024-50393 is classified as a high-severity command injection vulnerability.

Q: How do I fix CVE-2024-50393?

To fix CVE-2024-50393, upgrade to QTS versions 5.1.9.2954 build 2 or later, or QTS 5.2.2.2950 and above.

Q: Which QNAP products are affected by CVE-2024-50393?

CVE-2024-50393 affects several versions of QNAP QTS and QuTS hero operating systems.

Q: Can CVE-2024-50393 be exploited remotely?

Yes, CVE-2024-50393 can be exploited by remote attackers to execute arbitrary commands.

Q: Is there a patch available for CVE-2024-50393?

Yes, patches are available in the specified updated versions of QNAP operating systems.

Published Dec 6, 2024

Updated

A command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote attackers to execute arbitrary commands.

We have already fixed the vulnerability in the following versions: QTS 5.1.9.2954 build 20241120 and later QTS 5.2.2.2950 build 20241114 and later QuTS hero h5.1.9.2954 build 20241120 and later QuTS hero h5.2.2.2952 build 20241116 and later

Affected Software

50 affected components

QNAP QTS<5.1.9.2954

QNAP QTS<5.2.2.2950

QNAP QuTS hero<h5.1.9.2954

QNAP QuTS hero<h5.2.2.2952

QNAP QTS=5.1.0.2348-build_20230325

QNAP QTS=5.1.0.2399-build_20230515

QNAP QTS=5.1.0.2418-build_20230603

QNAP QTS=5.1.0.2444-build_20230629

QNAP QTS=5.1.0.2466-build_20230721

QNAP QTS=5.1.1.2491-build_20230815

QNAP QTS=5.1.2.2533-build_20230926

QNAP QTS=5.1.3.2578-build_20231110

QNAP QTS=5.1.4.2596-build_20231128

QNAP QTS=5.1.5.2645-build_20240116

QNAP QTS=5.1.5.2679-build_20240219

QNAP QTS=5.1.6.2722-build_20240402

QNAP QTS=5.1.7.2770-build_20240520

QNAP QTS=5.1.8.2823-build_20240712

QNAP QTS=5.2.0.2737-build_20240417

QNAP QTS=5.2.0.2744-build_20240424

QNAP QTS=5.2.0.2782-build_20240601

QNAP QTS=5.2.0.2802-build_20240620

QNAP QTS=5.2.0.2823-build_20240711

QNAP QTS=5.2.0.2851-build_20240808

QNAP QTS=5.2.0.2860-build_20240817

QNAP QTS=5.2.1.2930-build_20241025

QNAP QuTS hero=h5.1.0.2409-build_20230525

QNAP QuTS hero=h5.1.0.2424-build_20230609

QNAP QuTS hero=h5.1.0.2453-build_20230708

QNAP QuTS hero=h5.1.0.2466-build_20230721

QNAP QuTS hero=h5.1.1.2488-build_20230812

QNAP QuTS hero=h5.1.2.2534-build_20230927

QNAP QuTS hero=h5.1.3.2578-build_20231110

QNAP QuTS hero=h5.1.4.2596-build_20231128

QNAP QuTS hero=h5.1.5.2647-build_20240118

QNAP QuTS hero=h5.1.5.2680-build_20240220

QNAP QuTS hero=h5.1.6.2734-build_20240414

QNAP QuTS hero=h5.1.7.2770-build_20240520

QNAP QuTS hero=h5.1.7.2788-build_20240607

QNAP QuTS hero=h5.1.7.2794-build_20240613

QNAP QuTS hero=h5.1.8.2823-build_20240712

QNAP QuTS hero=h5.2.0.2737-build_20240417

QNAP QuTS hero=h5.2.0.2782-build_20240601

QNAP QuTS hero=h5.2.0.2789-build_20240607

QNAP QuTS hero=h5.2.0.2802-build_20240620

QNAP QuTS hero=h5.2.0.2823-build_20240711

QNAP QuTS hero=h5.2.0.2851-build_20240808

QNAP QuTS hero=h5.2.0.2860-build_20240817

QNAP QuTS hero=h5.2.1.2929-build_20241025

QNAP QuTS hero=h5.2.1.2940-build_20241105

Remediation

Information

Event History

Dec 6, 2024

CVE Published

via MITRE·04:36 PM

Data Sourced

via MITRE·04:36 PM

RemedyDescriptionWeakness

Data Sourced

via NVD·05:15 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2024-50393?

CVE-2024-50393 is classified as a high-severity command injection vulnerability.

How do I fix CVE-2024-50393?