CVE-2023-47218

Severity CVSS v4.0:

Pending analysis

Type:

CWE-77 Command Injection

Publication date:

13/02/2024

Last modified:

10/12/2025

Description

An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow users to execute commands via a network. We have already fixed the vulnerability in the following versions: QTS 5.1.5.2645 build 20240116 and later QuTS hero h5.1.5.2647 build 20240118 and later QuTScloud c5.1.5.2651 and later

Impact

Vector 3.x

CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L CVSS v3.1 Severity and Metrics:

Base Score: 5.80 MEDIUM
Vector: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L

Attack Vector (AV): Adjacent
Attack Complexity (AC): High
Privileges Required (PR): None
User Interaction (UI): None
Scope (S): Changed
Confidentiality (C): Low
Integrity (I): Low
Availability (A): Low

Base Score 3.x

5.80

Severity 3.x

MEDIUM

Vulnerable products and versions

CPE	From	Up to
cpe:2.3:o:qnap:qts::::::::	5.1.0 (including)	5.1.5.2645 (excluding)
cpe:2.3:o:qnap:qts:5.1.5.2645:-::::::
cpe:2.3:o:qnap:quts_hero::::::::	h5.1.0 (including)	h5.1.5.2647 (excluding)
cpe:2.3:o:qnap:quts_hero:h5.1.5.2647:-::::::
cpe:2.3:o:qnap:qutscloud::::::::	c5.0.0.1919 (including)	c5.1.5.2651 (excluding)

To consult the complete list of CPE names with products and versions, see this page

CVE-2023-47218

Description

Impact

Vulnerable products and versions

References to Advisories, Solutions, and Tools