Vulners
Lucene search
CVE-2023-47218
🗓️ 13 Feb 2024 02:44:14Reported by qnapType 
cve🔗 web.nvd.nist.gov📰️ 4 Media mentions👁 150 Views🌐 WEB
| Reporter | Title | Published | Views | Family All 25 |
|---|---|---|---|---|
 | QNAP QTS / QuTS Hero Unauthenticated Remote Code Execution Exploit | 22 Feb 202400:00 | – | zdt |
 | The vulnerability of the Quick.cgi file allows attackers to execute arbitrary commands on QTS, QuTS hero, and QuTScloud operating systems for network devices from Qnap. | 17 Apr 202400:00 | – | bdu_fstec |
 | CVE-2023-47218 | 13 Feb 202404:31 | – | circl |
 | Command Injection Vulnerabilities in Various QNAP Products | 13 Feb 202400:00 | – | cnnvd |
 | CVE-2023-47218 QTS, QuTS hero, QuTScloud | 13 Feb 202402:44 | – | cvelist |
 | QNAP QTS and QuTS Hero Unauthenticated Remote Code Execution in quick.cgi | 21 Feb 202419:49 | – | metasploit |
 | QNAP QTS and QuTS Hero - OS Command Injection | 19 Jul 202603:00 | – | nuclei |
 | CVE-2023-47218 | 13 Feb 202403:15 | – | nvd |
 | QNAP QTS Multiple OS Command Injection Vulnerabilities (QSA-23-57) - Version Check | 13 Feb 202400:00 | – | openvas |
| QNAP QuTS hero Multiple OS Command Injection Vulnerabilities (QSA-23-57) - Version Check | 13 Feb 202400:00 | – | openvas |
10
[
{
"defaultStatus": "unaffected",
"product": "QTS",
"vendor": "QNAP Systems Inc.",
"versions": [
{
"lessThan": "5.1.5.2645 build 20240116",
"status": "affected",
"version": "5.1.x",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "4.x"
}
]
},
{
"defaultStatus": "unaffected",
"product": "QuTS hero",
"vendor": "QNAP Systems Inc.",
"versions": [
{
"lessThan": "h5.1.5.2647 build 20240118",
"status": "affected",
"version": "h5.1.x",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "h4.x"
}
]
},
{
"defaultStatus": "unaffected",
"product": "QuTScloud",
"vendor": "QNAP Systems Inc.",
"versions": [
{
"lessThan": "c5.1.5.2651",
"status": "affected",
"version": "c5.x",
"versionType": "custom"
}
]
}
]| Parameter | Position | Path | Description | CWE |
|---|---|---|---|---|
| func | query param | /cgi-bin/quick/quick.cgi | Unauthenticated command injection via quick.cgi accessed on vulnerable QNAP devices. | CWE-77, CWE-78 |
| todo | upload data | /cgi-bin/quick/quick.cgi | Command injection achieved by uploading a payload via multipart/form-data to quick.cgi (uploaf_firmware_image path) and executing it. | CWE-77, CWE-78 |
| func | upload data | /cgi-bin/quick/quick.cgi | Command injection achieved by uploading a payload via multipart/form-data to quick.cgi (uploaf_firmware_image path) and executing it. | CWE-77, CWE-78 |
Data
Build on a solid foundation with Vulners data
We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data
Api
Power your application with Vulners API
The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access
App
Assess and manage vulnerabilities with Vulners tools
Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation
17 Jun 2026 06:32Current
6.3Medium risk
Vulners AI Score6.3
CVSS 3.15.8 - 8.3
EPSS0.8992
SSVC