QTS, QuTS hero, QuTScloud

Vulnerability

An OS command injection vulnerability exists in QNAP QTS, QuTS hero, and QuTScloud operating systems. The flaw allows authenticated administrators to execute arbitrary commands via network. Affected versions include QTS 5.1.x, QuTS hero h5.1.x, and QuTScloud c5.x. The vulnerability is fixed in QTS 5.1.5.2645 build 20240116 and later, QuTS hero h5.1.5.2647 build 20240118 and later, and QuTScloud c5.1.5.2651 and later [1].

Exploitation

An attacker must be an authenticated administrator with network access to the QNAP device. The vulnerability is exploited by sending a crafted request that injects OS commands into a vulnerable parameter. No user interaction beyond the attacker's own administrative actions is required. The exact injection point or required configuration is not disclosed in the available references [1].

Impact

Successful exploitation allows an authenticated administrator to execute arbitrary OS commands on the device. This can lead to full compromise of the NAS system, including data exfiltration, modification, or denial of service. The attacker gains root-level command execution capabilities [1].

Mitigation

QNAP has released fixed versions: QTS 5.1.5.2645 build 20240116 and later, QuTS hero h5.1.5.2647 build 20240118 and later, and QuTScloud c5.1.5.2651 and later. Users should update their device firmware via Control Panel > System > Firmware Update or by downloading from the QNAP Download Center. No workaround is provided if the patch cannot be applied immediately [1].