Evil-DB LogoEvil-DB
← All CVEs

CVE-2023-50358

medium · 5.8

An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow users to execute commands via a network. We have already fixed the vulnerability in the following versions: QTS 5.1.5.2645 build 20240116 and later QTS 4.5.4.2627 build 20231225 and later QTS 4.3.6.2665 build 20240131 and later QTS 4.3.4.2675 build 20240131 and later QTS 4.3.3.2644 build 20240131 and later QTS 4.2.6 build 20240131 and later QuTS hero h5.1.5.2647 build 20240118 and later QuTS hero h4.5.4.2626 build 20231225 and later QuTScloud c5.1.5.2651 and later

5.8
CVSS
13.5%
EPSS (exploit prob.)
96th
EPSS percentile
2024-02-13
Published

CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L

Weaknesses

CWE-78

Affected products

VendorProductAffected versions
qnapqts>= 4.2.0, < 4.2.6
qnapqts>= 4.3.0, < 4.3.3.2644
qnapqts>= 4.3.4, < 4.3.4.2675
qnapqts>= 4.3.5, < 4.3.6.2665
qnapqts>= 4.5.1, < 4.5.4.2627
qnapqts>= 5.1.0, < 5.1.5.2645
qnapqts4.2.6
qnapqts4.2.6
qnapqts4.2.6
qnapqts4.2.6
qnapqts4.2.6
qnapqts4.2.6
qnapqts4.2.6
qnapqts4.2.6
qnapqts4.2.6
qnapqts4.2.6
qnapqts4.2.6
qnapqts4.2.6
qnapqts4.2.6
qnapqts4.2.6
qnapqts4.2.6
qnapqts4.2.6
qnapqts4.5.4.2627
qnapqts5.1.5.2645
qnapquts_hero>= h4.5.0, < h4.5.4.2626
qnapquts_hero>= h5.0.0, < h5.1.5.2647
qnapquts_heroh4.5.4.2626
qnapquts_heroh5.1.5.2647
qnapqutscloud>= c5.0.0.1919, < c5.1.5.2651

Check a specific version with /api/v1/cve/match.

References

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2023-50358