title: Command Injection Vulnerability in QTS and QuTS hero
description: This command injection vulnerability allows attackers to execute arbitrary commands in a compromised application. QNAP have already fixed this vulnerability in the following versions of QTS and QuTS hero.
problem types: CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')
affected:
{
platforms: build 20201123
product: QTS
vendor: QNAP Systems Inc.
versions:
lessThan: 4.5.1.1495, status: affected, version: unspecified, versionType: custom
}
{
platforms: build 20200930
product: QTS
vendor: QNAP Systems Inc.
versions:
lessThanOrEqual: 4.4.3.1444, status: affected, version: unspecified, versionType: custom
}
{
product: QTS
vendor: QNAP Systems Inc.
versions:
status: unaffected, version: 4.3.x
status: unaffected, version: 4.2.x
}
{
platforms: build 20201119
product: QuTS hero
vendor: QNAP Systems Inc.
versions:
lessThan: h4.5.1.1491, status: affected, version: unspecified, versionType: custom
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
]
solutions: QNAP have already fixed this vulnerability in the following versions of QTS and QuTS hero.
QuTS hero h4.5.1.1491 build 20201119 and later
QTS 4.5.1.1495 build 20201123 and later
This issue does not affect QTS 4.3.x and QTS 4.2.x.