title: Command Injection Vulnerabilities in QTS and QuTS hero
description: A command injection vulnerabilities have been reported to affect QTS and QuTS hero. If exploited, this vulnerability allows attackers to execute arbitrary commands in a compromised application. This issue affects: QNAP Systems Inc. QTS versions prior to 4.5.1.1540 build 20210107. QNAP Systems Inc. QuTS hero versions prior to h4.5.1.1582 build 20210217.
problem types: CWE-78 OS Command Injection
affected:
{
product: QTS
vendor: QNAP Systems Inc.
versions:
lessThan: 4.5.1.1540 build 20210107, status: affected, version: unspecified, versionType: custom
}
{
product: QuTS hero
vendor: QNAP Systems Inc.
versions:
lessThan: h4.5.1.1582 build 20210217, status: affected, version: unspecified, versionType: custom
}
solutions: QNAP have already fixed this vulnerability in the following versions:
QTS 4.5.1.1540 build 20210107 and later
QuTS hero h4.5.1.1582 build 20210217 and later