CVE-2023-23367: QTS, QuTS hero, QuTScloud

Severity: high (CVSS 7.2 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-11-10 · updated 2026-06-17
Weakness: CWE-78

Description

An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated administrators to execute commands via a network. We have already fixed the vulnerability in the following versions: QTS 5.0.1.2376 build 20230421 and later QuTS hero h5.0.1.2376 build 20230421 and later QuTScloud c5.1.0.2498 and later

Affected products

QNAP QTS: 5.0.0.1716-build_20210701, 5.0.0.1785-build_20210908, 5.0.0.1808-build_20211001, 5.0.0.1828-build_20211020, 5.0.0.1837-build_20211029, 5.0.0.1850-build_20211111 (+14)
QNAP Systems Inc. QuTS hero: h5.0.0.1772-build_20210826, h5.0.0.1844-build_20211105, h5.0.0.1856-build_20211117, h5.0.0.1892-build_20211222, h5.0.0.1900-build_20211228, h5.0.0.1949-build_20220215 (+10)
QNAP Systems Inc. QuTScloud: c5.0.0.1919-build_20220119, c5.0.1.1949-build_20220218, c5.0.1.1998-build_20220408, c5.0.1.2044-build_20220524, c5.0.1.2148-build_20220905, c5.0.1.2374-build_20230419

References

Get alerted when CVE-2023-23367 or the next vulnerability affects your stack