CVSS3
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS4
Attack Vector
PHYSICAL
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
ACTIVE
CVSS:4.0/AV:P/AC:H/AT:P/PR:N/UI:A/VC:H/SC:H/VI:H/SI:H/VA:H/SA:H
AI Score
Confidence
High
EPSS
Percentile
10.2%
An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow local network users to execute commands via unspecified vectors.
We have already fixed the vulnerability in the following versions:
QTS 5.1.8.2823 build 20240712 and later
QuTS hero h5.1.8.2823 build 20240712 and later
Vendor | Product | Version | CPE |
---|---|---|---|
qnap | qts | 5.1.0.2348 | cpe:2.3:o:qnap:qts:5.1.0.2348:build_20230325:*:*:*:*:*:* |
qnap | qts | 5.1.0.2399 | cpe:2.3:o:qnap:qts:5.1.0.2399:build_20230515:*:*:*:*:*:* |
qnap | qts | 5.1.0.2418 | cpe:2.3:o:qnap:qts:5.1.0.2418:build_20230603:*:*:*:*:*:* |
qnap | qts | 5.1.0.2444 | cpe:2.3:o:qnap:qts:5.1.0.2444:build_20230629:*:*:*:*:*:* |
qnap | qts | 5.1.0.2466 | cpe:2.3:o:qnap:qts:5.1.0.2466:build_20230721:*:*:*:*:*:* |
qnap | qts | 5.1.1.2491 | cpe:2.3:o:qnap:qts:5.1.1.2491:build_20230815:*:*:*:*:*:* |
qnap | qts | 5.1.2.2533 | cpe:2.3:o:qnap:qts:5.1.2.2533:build_20230926:*:*:*:*:*:* |
qnap | qts | 5.1.3.2578 | cpe:2.3:o:qnap:qts:5.1.3.2578:build_20231110:*:*:*:*:*:* |
qnap | qts | 5.1.4.2596 | cpe:2.3:o:qnap:qts:5.1.4.2596:build_20231128:*:*:*:*:*:* |
qnap | qts | 5.1.5.2645 | cpe:2.3:o:qnap:qts:5.1.5.2645:build_20240116:*:*:*:*:*:* |
[
{
"defaultStatus": "unaffected",
"product": "QTS",
"vendor": "QNAP Systems Inc.",
"versions": [
{
"lessThan": "5.1.8.2823 build 20240712",
"status": "affected",
"version": "5.1.x",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "QuTS hero",
"vendor": "QNAP Systems Inc.",
"versions": [
{
"lessThan": "h5.1.8.2823 build 20240712",
"status": "affected",
"version": "h5.1.x",
"versionType": "custom"
}
]
}
]
CVSS3
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS4
Attack Vector
PHYSICAL
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
ACTIVE
CVSS:4.0/AV:P/AC:H/AT:P/PR:N/UI:A/VC:H/SC:H/VI:H/SI:H/VA:H/SA:H
AI Score
Confidence
High
EPSS
Percentile
10.2%