QTS, QuTS hero, QuTScloud

Vulnerability

The vulnerability resides in the quick.cgi component of QNAP QTS and QuTS hero operating systems, which is exposed via the web-based administration interface on uninitialized NAS devices. This component is intended for initial device provisioning and is disabled after successful initialization. Affected versions include QTS 5.x and 4.x, QuTS hero h5.x and h4.x, and QuTScloud 5.x. The issue is an OS command injection flaw that allows unauthenticated remote code execution [1][2].

Exploitation

An attacker with network access to an uninitialized QNAP NAS device can exploit this vulnerability without authentication. By sending specially crafted HTTP requests to the quick.cgi endpoint, the attacker can inject arbitrary operating system commands. The device must not have been previously initialized (i.e., still in its out-of-box state) for the endpoint to be active [1].

Impact

Successful exploitation allows an attacker to execute arbitrary commands on the target NAS device with root privileges. This can lead to full compromise of the device, including data exfiltration, installation of malware, and further lateral movement within the network [1][2].

Mitigation

QNAP has released fixed versions: QTS 5.1.5.2645 build 20240116 and later, QuTS hero h5.1.5.2647 build 20240118 and later, and QuTScloud c5.1.5.2651 and later. Partially fixed versions are also available for some product lines (e.g., QTS 5.1.0.2444) but full remediation requires installing the fully fixed version [2]. The vendor advisory (QSA-23-57) provides detailed version information [2]. No workaround is available; users should update immediately.