← Back

CVE-2024-50393

nvd nist
Published: Dec 6, 2024Modified: Jun 17, 2026

JSON object

Loading...
8.7
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Show more
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XShow less
Source: security@qnapsecurity.com.tw (Secondary)

Description

A command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote attackers to execute arbitrary commands. We have already fixed the vulnerability in the following versions: QTS 5.1.9.2954 build 20241120 and later QTS 5.2.2.2950 build 20241114 and later QuTS hero h5.1.9.2954 build 20241120 and later QuTS hero h5.2.2.2952 build 20241116 and later

Affected (46)

Products: Qnap: Qts, Quts Hero
Qnap
2 products
Qts
Quts Hero
Configuration A
22 vulnerable
Vulnerable SoftwareAffected Versions
Qnap
Qts
Version 5.1.0.2348 build_20230325
Qts
Version 5.1.0.2399 build_20230515
Qts
Version 5.1.0.2418 build_20230603
Qts
Version 5.1.0.2444 build_20230629
Qts
Version 5.1.0.2466 build_20230721
Qts
Version 5.1.1.2491 build_20230815
Qts
Version 5.1.2.2533 build_20230926
Qts
Version 5.1.3.2578 build_20231110
Qts
Version 5.1.4.2596 build_20231128
Qts
Version 5.1.5.2645 build_20240116
Qts
Version 5.1.5.2679 build_20240219
Qts
Version 5.1.6.2722 build_20240402
Qts
Version 5.1.7.2770 build_20240520
Qts
Version 5.1.8.2823 build_20240712
Qts
Version 5.2.0.2737 build_20240417
Qts
Version 5.2.0.2744 build_20240424
Qts
Version 5.2.0.2782 build_20240601
Qts
Version 5.2.0.2802 build_20240620
Qts
Version 5.2.0.2823 build_20240711
Qts
Version 5.2.0.2851 build_20240808
Qts
Version 5.2.0.2860 build_20240817
Qts
Version 5.2.1.2930 build_20241025
Configuration B
24 vulnerable
Vulnerable SoftwareAffected Versions
Qnap
Quts Hero
Version h5.1.0.2409 build_20230525
Quts Hero
Version h5.1.0.2424 build_20230609
Quts Hero
Version h5.1.0.2453 build_20230708
Quts Hero
Version h5.1.0.2466 build_20230721
Quts Hero
Version h5.1.1.2488 build_20230812
Quts Hero
Version h5.1.2.2534 build_20230927
Quts Hero
Version h5.1.3.2578 build_20231110
Quts Hero
Version h5.1.4.2596 build_20231128
Quts Hero
Version h5.1.5.2647 build_20240118
Quts Hero
Version h5.1.5.2680 build_20240220
Quts Hero
Version h5.1.6.2734 build_20240414
Quts Hero
Version h5.1.7.2770 build_20240520
Quts Hero
Version h5.1.7.2788 build_20240607
Quts Hero
Version h5.1.7.2794 build_20240613
Quts Hero
Version h5.1.8.2823 build_20240712
Quts Hero
Version h5.2.0.2737 build_20240417
Quts Hero
Version h5.2.0.2782 build_20240601
Quts Hero
Version h5.2.0.2789 build_20240607
Quts Hero
Version h5.2.0.2802 build_20240620
Quts Hero
Version h5.2.0.2823 build_20240711
Quts Hero
Version h5.2.0.2851 build_20240808
Quts Hero
Version h5.2.0.2860 build_20240817
Quts Hero
Version h5.2.1.2929 build_20241025
Quts Hero
Version h5.2.1.2940 build_20241105

Related CWEs

CWE-78
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

References (1)

Source: security@qnapsecurity.com.tw
Vendor Advisory

Timeline

No history available yet.