CVE-2023-23355: QNAP QTS

High severity, CVSS 7.2. EPSS: 1.2% chance of exploitation in the next 30 days.

An OS command injection vulnerability has been reported to affect QNAP operating systems. If exploited, the vulnerability possibly allows remote authenticated administrators to execute commands via unspecified vectors. QES is not affected. We have already fixed the vulnerability in the following versions: QTS 5.0.1.2346 build 20230322 and later QTS 4.5.4.2374 build 20230416 and later QuTS hero h5.0.1.2348 build 20230324 and later QuTS hero h4.5.4.2374 build 20230417 and later QuTScloud c5.0.1.2374 and later

Affected products

• QNAP QTS: before 5.0.1.2346 (fixed in 5.0.1.2346)
• QNAP Quts Hero: before h5.0.1.2348 (fixed in h5.0.1.2348)
• QNAP Qutscloud: affected versions not specified
• QNAP Qvp-21a Firmware: affected versions not specified
• QNAP Qvp-41a Firmware: affected versions not specified
• QNAP Qvp-41b Firmware: affected versions not specified
• QNAP Qvp-63a Firmware: affected versions not specified
• QNAP Qvp-63b Firmware: affected versions not specified
• QNAP Qvp-85a Firmware: affected versions not specified
• QNAP Qvp-85b Firmware: affected versions not specified
• QNAP Qvr: affected versions not specified

Published 2023-03-29. Last modified 2026-06-17.