QNAP Operating Systems Command Injection Vulnerability

A command injection vulnerability exists in several QNAP operating system versions. This vulnerability allows an attacker with local network access and a user account to execute arbitrary commands. Affected QNAP operating system versions include QTS 5.1.9.2954 build 20241120 and earlier, QTS 5.2.3.3006 build 20250108 and earlier, QuTS hero h5.1.9.2954 build 20241120 and earlier, and QuTS hero h5.2.3.3006 build 20250108 and earlier.

Impact

Exploitation of this vulnerability allows for arbitrary command execution on the affected system.

Remediation

Users can upgrade to QTS 5.1.9.2954 build 20241120, QTS 5.2.3.3006 build 20250108, QuTS hero h5.1.9.2954 build 20241120, or QuTS hero h5.2.3.3006 build 20250108 to address this vulnerability.