QTS, QuTS hero, QuTScloud

Vulnerability

An injection vulnerability exists in multiple QNAP operating system versions, including QTS 5.x and 4.5.x, QuTS hero h5.x and h4.5.x, and QuTScloud c5.x [1]. The flaw allows authenticated users to inject and execute arbitrary commands through network requests. Affected versions are those prior to QTS 5.1.3.2578 build 20231110, QTS 4.5.4.2627 build 20231225, QuTS hero h5.1.3.2578 build 20231110, and QuTScloud c5.1.5.2651 [1].

Exploitation

An attacker must first obtain valid user credentials for the QNAP device. With authenticated access, the attacker can send specially crafted network requests to a vulnerable component, triggering command injection. No additional privileges or user interaction beyond authentication are required [1].

Impact

Successful exploitation allows the attacker to execute arbitrary commands with the privileges of the affected service, potentially leading to full system compromise, data exfiltration, or further lateral movement within the network [1].

Mitigation

QNAP has released fixed versions: QTS 5.1.3.2578 build 20231110 and later, QTS 4.5.4.2627 build 20231225 and later, QuTS hero h5.1.3.2578 build 20231110 and later, and QuTScloud c5.1.5.2651 and later [1]. Users should upgrade to these versions immediately. No workarounds have been provided, and the vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog.