title: Command injection
description: A command injection vulnerability has been reported to affect QNAP NAS running QuTScloud, QuTS hero and QTS. If exploited, this vulnerability allows remote attackers to run arbitrary commands. We have already fixed this vulnerability in the following versions of QuTScloud, QuTS hero and QTS: QuTScloud c5.0.1.1949 and later QuTS hero h5.0.0.1986 build 20220324 and later QTS 5.0.0.1986 build 20220324 and later
problem types: CWE-77
affected:
{
product: QuTScloud
vendor: QNAP Systems Inc.
versions:
lessThan: c5.0.1.1949, status: affected, version: unspecified, versionType: custom
}
{
product: QuTS hero
vendor: QNAP Systems Inc.
versions:
lessThan: h5.0.0.1986 build 20220324, status: affected, version: unspecified, versionType: custom
}
{
product: QTS
vendor: QNAP Systems Inc.
versions:
lessThan: 5.0.0.1986 build 20220324, status: affected, version: unspecified, versionType: custom
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
]
solutions: We have already fixed this vulnerability in the following versions of QuTScloud, QuTS hero and QTS:
QuTScloud c5.0.1.1949 and later
QuTS hero h5.0.0.1986 build 20220324 and later
QTS 5.0.0.1986 build 20220324 and later