QTS, QuTS hero, QuTScloud

Vulnerability

An OS command injection vulnerability exists in QNAP QTS, QuTS hero, and QuTScloud operating systems. The flaw can be triggered when the system is in a certain configuration, allowing command injection via network requests. Affected versions include QTS 5.1.x and 4.5.x, QuTS hero h5.1.x and h4.5.x, and QuTScloud 5.x [1].

Exploitation

To exploit this vulnerability, an attacker must have network access and the ability to send specially crafted requests to the affected system. User interaction may be required depending on the specific configuration. The exact attack vector and necessary privileges are not detailed in the available references [1].

Impact

Successful exploitation can allow users to execute arbitrary operating system commands on the device via the network. This could lead to full compromise of the NAS, including data exposure, modification, or disruption of services [1].

Mitigation

QNAP has fixed the vulnerability in the following versions: QTS 5.1.4.2596 build 20231128 and later, QTS 4.5.4.2627 build 20231225 and later, QuTS hero h5.1.4.2596 build 20231128 and later, QuTS hero h4.5.4.2626 build 20231225 and later, and QuTScloud c5.1.5.2651 and later [1]. Users should update their systems to the latest available version. No workarounds are provided.