QTS, QuTS hero, QuTScloud

Vulnerability

An OS command injection vulnerability exists in QNAP QTS versions 5.1.x and 4.5.x, QuTS hero versions h5.1.x and h4.5.x, and QuTScloud version 5.x. The flaw allows an authenticated user to inject arbitrary OS commands through a network request. The vulnerability is present in these operating systems before the fixed versions listed in the advisory [1].

Exploitation

An attacker must have valid user credentials and network access to the affected device. The exact attack vector is not publicly detailed, but the advisory confirms that an authenticated user can send specially crafted input over the network to trigger command injection [1].

Impact

Successful exploitation enables an authenticated attacker to execute arbitrary OS commands with the privileges of the vulnerable service. This can lead to full system compromise, including data disclosure, modification, or denial of service [1].

Mitigation

QNAP has released fixed versions: QTS 5.1.4.2596 build 20231128 and later, QTS 4.5.4.2627 build 20231225 and later, QuTS hero h5.1.4.2596 build 20231128 and later, QuTS hero h4.5.4.2626 build 20231225 and later, and QuTScloud c5.1.5.2651 and later [1]. Users should update their systems via the firmware update mechanism or download from the QNAP support site. No workaround is provided.