An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow users to execute commands via a network.
We have already fixed the vulnerability in the following versions:
QTS 5.1.5.2645 build 20240116 and later
QuTS hero h5.1.5.2647 build 20240118 and later
QuTScloud c5.1.5.2651 and later
References
| Link | Resource |
|---|---|
| https://www.qnap.com/en/security-advisory/qsa-23-57 | Vendor Advisory |
| https://www.rapid7.com/blog/post/2024/02/13/cve-2023-47218-qnap-qts-and-quts-hero-unauthenticated-command-injection-fixed/ | Exploit Third Party Advisory |
| https://www.qnap.com/en/security-advisory/qsa-23-57 | Vendor Advisory |
| https://www.rapid7.com/blog/post/2024/02/13/cve-2023-47218-qnap-qts-and-quts-hero-unauthenticated-command-injection-fixed/ | Exploit Third Party Advisory |
Configurations
Configuration 1 (hide)
|
History
10 Dec 2025, 22:13
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Qnap qts
Qnap qutscloud Qnap quts Hero Qnap |
|
| CPE | cpe:2.3:o:qnap:qutscloud:*:*:*:*:*:*:*:* cpe:2.3:o:qnap:qts:*:*:*:*:*:*:*:* cpe:2.3:o:qnap:quts_hero:h5.1.5.2647:-:*:*:*:*:*:* cpe:2.3:o:qnap:qts:5.1.5.2645:-:*:*:*:*:*:* cpe:2.3:o:qnap:quts_hero:*:*:*:*:*:*:*:* |
|
| References | () https://www.qnap.com/en/security-advisory/qsa-23-57 - Vendor Advisory | |
| References | () https://www.rapid7.com/blog/post/2024/02/13/cve-2023-47218-qnap-qts-and-quts-hero-unauthenticated-command-injection-fixed/ - Exploit, Third Party Advisory |
13 Feb 2025, 18:15
| Type | Values Removed | Values Added |
|---|---|---|
| Summary | (en) An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow users to execute commands via a network. We have already fixed the vulnerability in the following versions: QTS 5.1.5.2645 build 20240116 and later QuTS hero h5.1.5.2647 build 20240118 and later QuTScloud c5.1.5.2651 and later |
21 Nov 2024, 08:29
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://www.qnap.com/en/security-advisory/qsa-23-57 - | |
| References | () https://www.rapid7.com/blog/post/2024/02/13/cve-2023-47218-qnap-qts-and-quts-hero-unauthenticated-command-injection-fixed/ - |
15 Feb 2024, 06:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
13 Feb 2024, 03:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2024-02-13 03:15
Updated : 2025-12-10 22:13
NVD link : CVE-2023-47218
Mitre link : CVE-2023-47218
CVE.ORG link : CVE-2023-47218
JSON object : View
Products Affected
qnap
- qutscloud
- qts
- quts_hero