CVE-2023-47218

🗓️ 13 Feb 2024 02:44:14Reported by qnapType

cve🔗 web.nvd.nist.gov📰️ 4 Media mentions👁 174 Views🌐 WEB

OS command injection vulnerability in QNAP OS version

Reporter	Title	Published	Views	Family All 26
zdt	QNAP QTS / QuTS Hero Unauthenticated Remote Code Execution Exploit	22 Feb 202400:00	–	zdt
BDU FSTEC	The vulnerability of the Quick.cgi file allows attackers to execute arbitrary commands on QTS, QuTS hero, and QuTScloud operating systems for network devices from Qnap.	17 Apr 202400:00	–	bdu_fstec
Circl	CVE-2023-47218	13 Feb 202404:31	–	circl
CNNVD	Command Injection Vulnerabilities in Various QNAP Products	13 Feb 202400:00	–	cnnvd
Cvelist	CVE-2023-47218 QTS, QuTS hero, QuTScloud	13 Feb 202402:44	–	cvelist
Kitploit	CVE-2023-47218	29 Aug 202613:39	–	kitploit
Metasploit	QNAP QTS and QuTS Hero Unauthenticated Remote Code Execution in quick.cgi	13 Feb 202400:00	–	metasploit
Nuclei	QNAP QTS and QuTS Hero - OS Command Injection	31 Aug 202605:18	–	nuclei
NVD	CVE-2023-47218	13 Feb 202403:15	–	nvd
OpenVAS	QNAP QTS Multiple OS Command Injection Vulnerabilities (QSA-23-57) - Version Check	13 Feb 202400:00	–	openvas

NVD

Node

qnap qtsRange5.1.0–5.1.5.2645

qnap qtsMatch5.1.5.2645-

qnap quts_heroRangeh5.1.0–h5.1.5.2647

qnap quts_heroMatchh5.1.5.2647-

qnap qutscloudRangec5.0.0.1919–c5.1.5.2651

[
  {
    "defaultStatus": "unaffected",
    "product": "QTS",
    "vendor": "QNAP Systems Inc.",
    "versions": [
      {
        "lessThan": "5.1.5.2645 build 20240116",
        "status": "affected",
        "version": "5.1.x",
        "versionType": "custom"
      },
      {
        "status": "unaffected",
        "version": "4.x"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "product": "QuTS hero",
    "vendor": "QNAP Systems Inc.",
    "versions": [
      {
        "lessThan": "h5.1.5.2647 build 20240118",
        "status": "affected",
        "version": "h5.1.x",
        "versionType": "custom"
      },
      {
        "status": "unaffected",
        "version": "h4.x"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "product": "QuTScloud",
    "vendor": "QNAP Systems Inc.",
    "versions": [
      {
        "lessThan": "c5.1.5.2651",
        "status": "affected",
        "version": "c5.x",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
qnap	www.qnap.com/en/security-advisory/qsa-23-57
rapid7	www.rapid7.com/blog/post/2024/02/13/cve-2023-47218-qnap-qts-and-quts-hero-unauthenticated-command-injection-fixed/