CVE-2023-47218

PoC —

CVSS 3.1

8.3 high

EPSS

90%p100

Published

Feb 13, 2024 (Feb 13, 2024)

Modified

Jun 17, 2026

Description

An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow users to execute commands via a network. We have already fixed the vulnerability in the following versions: QTS 5.1.5.2645 build 20240116 and later QuTS hero h5.1.5.2647 build 20240118 and later QuTScloud c5.1.5.2651 and later

Vendors: qnap
Products: qts, quts hero, qutscloud
Weakness: CWE-77, CWE-78
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L

NVD CVE.org GitHub PoCs EPSS (89.9%)

In the news3 stories

Week in review: AnyDesk phishing campaign targets employees, Microsoft fixes exploited zero-days

Help Net SecurityFeb 18, 00:00 UTC · Feb 18, 2024Exploit / PoC in the wildCVE-2024-21762 CVE-2024-23313 CVE-2023-43770+5 CVEs

Microsoft Rolls Out Patches for 73 Flaws, Including 2 Windows Zero

The Hacker NewsFeb 15, 00:00 UTC · Feb 15, 2024Vulnerability in the wildCVE-2024-21351 CVE-2024-21412 CVE-2023-36025+9 CVEs1

QNAP fixes OS command injection flaws affecting its NAS devices (CVE-2023-47218, CVE-2023-50358)

Help Net SecurityFeb 14, 00:00 UTC · Feb 14, 2024Vulnerability CVE-2023-47218 CVE-2023-50358 CVE-2023-47565