QNAP Operating System Command Injection Vulnerability Allowing Execution Logic Alteration

A command injection vulnerability has been identified in several QNAP operating system versions. This issue arises from improper handling of argument delimiters, allowing remote attackers to manipulate execution logic. The vulnerability has been addressed in QTS 5.2.7.3297 build 20251024 and later, as well as QuTS hero h5.2.7.3297 build 20251024 and h5.3.1.3292 build 20251024.

Impact

Exploitation of this vulnerability allows remote attackers to alter the execution logic on the affected system, potentially leading to unauthorized command execution or manipulation of system processes.

Remediation

Users can upgrade to QTS 5.2.7.3297 build 20251024 or later, or QuTS hero h5.2.7.3297 build 20251024 or h5.3.1.3292 build 20251024 to address this vulnerability.