title: Vulnerability in QTS
description: A vulnerability has been reported to affect QNAP device running QuTS hero, QTS. If exploited, this vulnerability allows remote attackers to inject malicious code.
We have already fixed this vulnerability in the following versions of QuTS hero, QTS:
QuTS hero h5.0.1.2248 build 20221215 and later
QTS 5.0.1.2234 build 20221201 and later
problem types: CWE-89
affected:
{
defaultStatus: unaffected
product: QuTS hero
vendor: QNAP Systems Inc.
versions:
lessThan: h5.0.1.2248 build 20221215, status: affected, version: h5.0.1, versionType: custom
}
{
defaultStatus: unaffected
product: QTS
vendor: QNAP Systems Inc.
versions:
lessThan: 5.0.1.2234 build 20221201, status: affected, version: 5.0.1, versionType: custom
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
]
format: CVSS
scenarios: GENERAL
solutions: We have already fixed this vulnerability in the following versions of QuTS hero, QTS:
QuTS hero h5.0.1.2248 build 20221215 and later
QTS 5.0.1.2234 build 20221201 and later
