CVE-2023-47218
Published: 13 February 2024
Summary
CVE-2023-47218 is a medium-severity Command Injection (CWE-77) vulnerability in Qnap Qts. Its CVSS base score is 5.8 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 0.2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
An OS command injection vulnerability, tracked as CVE-2023-47218 and assigned CWE-77/CWE-78, affects multiple versions of QNAP QTS, QuTS hero, and QuTScloud operating systems. The flaw permits unauthenticated remote command execution over the network and carries a CVSS 3.1 score of 5.8 reflecting adjacent-network access, high attack complexity, and limited impacts with changed scope.
An attacker positioned on an adjacent network can exploit the issue without credentials or user interaction to run arbitrary operating-system commands on the affected NAS device. Successful exploitation could lead to limited confidentiality, integrity, and availability impacts that extend beyond the vulnerable component.
QNAP has addressed the vulnerability in QTS 5.1.5.2645 build 20240116 and later, QuTS hero h5.1.5.2647 build 20240118 and later, and QuTScloud c5.1.5.2651 and later; the vendor advisory QSA-23-57 recommends applying these updates. The associated EPSS score currently stands at 0.9315 with a recorded peak of 0.9329.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-51350
Vulnerability details
An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow users to execute commands via a network. We have already fixed the vulnerability in the following versions: QTS 5.1.5.2645…
more
build 20240116 and later QuTS hero h5.1.5.2647 build 20240118 and later QuTScloud c5.1.5.2651 and later
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Unauthenticated OS command injection in the public-facing quick.cgi web endpoint on uninitialized QNAP NAS devices enables exploitation of public-facing applications (T1190) and arbitrary Unix shell command execution via system() (T1059.004).
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.