CVE-2023-47218

🗓️ 13 Feb 2024 02:44:14Reported by qnapType

cve🔗 web.nvd.nist.gov📰️ 4 Media mentions👁 142 Views🌐 WEB

OS command injection vulnerability in QNAP OS version

Reporter	Title	Published	Views	Family All 25
0day.today	QNAP QTS / QuTS Hero Unauthenticated Remote Code Execution Exploit	22 Feb 202400:00	–	zdt
BDU FSTEC	The vulnerability of the Quick.cgi file allows attackers to execute arbitrary commands on QTS, QuTS hero, and QuTScloud operating systems for network devices from Qnap.	17 Apr 202400:00	–	bdu_fstec
Circl	CVE-2023-47218	13 Feb 202404:31	–	circl
CNNVD	Command Injection Vulnerabilities in Various QNAP Products	13 Feb 202400:00	–	cnnvd
Cvelist	CVE-2023-47218 QTS, QuTS hero, QuTScloud	13 Feb 202402:44	–	cvelist
Metasploit	QNAP QTS and QuTS Hero Unauthenticated Remote Code Execution in quick.cgi	21 Feb 202419:49	–	metasploit
Nuclei	QNAP QTS and QuTS Hero - OS Command Injection	26 Jun 202618:13	–	nuclei
NVD	CVE-2023-47218	13 Feb 202403:15	–	nvd
OpenVAS	QNAP QTS Multiple OS Command Injection Vulnerabilities (QSA-23-57) - Version Check	13 Feb 202400:00	–	openvas
OpenVAS	QNAP QuTS hero Multiple OS Command Injection Vulnerabilities (QSA-23-57) - Version Check	13 Feb 202400:00	–	openvas

NVD

Node

qnap qtsRange5.1.0–5.1.5.2645

qnap qtsMatch5.1.5.2645-

qnap quts_heroRangeh5.1.0–h5.1.5.2647

qnap quts_heroMatchh5.1.5.2647-

qnap qutscloudRangec5.0.0.1919–c5.1.5.2651

[
  {
    "defaultStatus": "unaffected",
    "product": "QTS",
    "vendor": "QNAP Systems Inc.",
    "versions": [
      {
        "lessThan": "5.1.5.2645 build 20240116",
        "status": "affected",
        "version": "5.1.x",
        "versionType": "custom"
      },
      {
        "status": "unaffected",
        "version": "4.x"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "product": "QuTS hero",
    "vendor": "QNAP Systems Inc.",
    "versions": [
      {
        "lessThan": "h5.1.5.2647 build 20240118",
        "status": "affected",
        "version": "h5.1.x",
        "versionType": "custom"
      },
      {
        "status": "unaffected",
        "version": "h4.x"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "product": "QuTScloud",
    "vendor": "QNAP Systems Inc.",
    "versions": [
      {
        "lessThan": "c5.1.5.2651",
        "status": "affected",
        "version": "c5.x",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
qnap	www.qnap.com/en/security-advisory/qsa-23-57
rapid7	www.rapid7.com/blog/post/2024/02/13/cve-2023-47218-qnap-qts-and-quts-hero-unauthenticated-command-injection-fixed/

Parameter	Position	Path	Description	CWE
func	query param	cgi-bin/quick/quick.cgi	Unauthenticated command injection via quick.cgi using GET parameter func	CWE-78, CWE-77
func	query param	cgi-bin/quick/quick.cgi	Command injection via uploading firmware image using switch_os and todo parameters on quick.cgi	CWE-78, CWE-77
todo	query param	cgi-bin/quick/quick.cgi	Command injection via uploading firmware image using switch_os and todo parameters on quick.cgi	CWE-78, CWE-77

17 Jun 2026 06:32Current

6.3Medium risk

Vulners AI Score6.3

CVSS 3.15.8 - 8.3

EPSS0.89157

SSVC

cve-2023-47218 qnap os command injection vulnerability network security