QTS, QuTS hero, QuTScloud

Vulnerability

An OS command injection vulnerability exists in QNAP QTS, QuTS hero, and QuTScloud operating systems. The flaw allows authenticated administrators to inject arbitrary OS commands through network requests. Affected versions include QTS 5.1.x, QuTS hero h5.1.x, and QuTScloud 5.x. The vulnerability has been fixed in QTS 5.1.4.2596 build 20231128 and later, QuTS hero h5.1.4.2596 build 20231128 and later, and QuTScloud c5.1.5.2651 and later [1].

Exploitation

An attacker must have administrative access to the QNAP device. No additional user interaction is required beyond the initial authentication. The attacker can send specially crafted network requests to the vulnerable system, which are not properly sanitized, leading to command injection [1].

Impact

Successful exploitation enables the attacker to execute arbitrary OS commands on the affected device. This can lead to full system compromise, including data exfiltration, installation of malware, or disruption of services. The commands are executed with the privileges of the vulnerable process, typically root [1].

Mitigation

QNAP has released fixed versions as listed above. Users should update their systems to the latest available version. No workarounds are provided. It is recommended to regularly update the firmware to benefit from security fixes [1].