Description (CNA)
An OS command injection vulnerability has been reported to affect legacy QTS. If exploited, the vulnerability could allow authenticated administrators to execute commands via a network. We have already fixed the vulnerability in the following versions: QTS 4.3.6.2805 build 20240619 and later QTS 4.3.4.2814 build 20240618 and later QTS 4.3.3.2784 build 20240619 and later QTS 4.2.6 build 20240618 and later
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| QNAP Systems Inc. / QTS | affected 4.3.6 before 4.3.6.2805 build 20240619; affected 4.3.4 before 4.3.4.2814 build 20240618; affected 4.3.3 before 4.3.3.2784 build 20240619; affected 4.2.6 before 4.2.6 build 20240618 |
| QNAP Systems Inc. / QTS | unaffected 5.x; unaffected 4.5.x |
| QNAP Systems Inc. / QuTS hero | unaffected h5.x; unaffected h4.5.x |
| QNAP Systems Inc. / QuTScloud | unaffected c5.x |
CWE
CWE-78
References
ADP enrichment
No English description supplied.
No references supplied.