What’s Vulnerable › Vulnerabilities

CVE-2023-23355: QTS, QuTS hero, QuTScloud, QVP (QVR Pro appliances), QVR

• Severity: high (CVSS 7.2 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2023-03-29 · updated 2026-06-17
• Weakness: CWE-77

Description

An OS command injection vulnerability has been reported to affect QNAP operating systems. If exploited, the vulnerability possibly allows remote authenticated administrators to execute commands via unspecified vectors. QES is not affected. We have already fixed the vulnerability in the following versions: QTS 5.0.1.2346 build 20230322 and later QTS 4.5.4.2374 build 20230416 and later QuTS hero h5.0.1.2348 build 20230324 and later QuTS hero h4.5.4.2374 build 20230417 and later QuTScloud c5.0.1.2374 and later

Affected products

• QNAP QTS: before 5.0.1.2346 — fixed in 5.0.1.2346
• QNAP Systems Inc. QuTS hero: before h5.0.1.2348 — fixed in h5.0.1.2348
• QNAP Systems Inc. QuTScloud: all versions
• QNAP Qvp-21A Firmware: all versions
• QNAP Qvp-41A Firmware: all versions
• QNAP Qvp-41B Firmware: all versions
• QNAP Qvp-63A Firmware: all versions
• QNAP Qvp-63B Firmware: all versions
• QNAP Qvp-85A Firmware: all versions
• QNAP Qvp-85B Firmware: all versions
• QNAP Systems Inc. QVR: all versions

How to fix

Upgrade to a fixed version: QNAP QTS 5.0.1.2346; QNAP Systems Inc. QuTS hero h5.0.1.2348. Check the vendor advisory for mitigations.

References

• https://www.qnap.com/en/security-advisory/qsa-23-10
• https://www.qnap.com/en/security-advisory/qsa-23-10

Get alerted when CVE-2023-23355 or the next vulnerability affects your stack