CVE-2023-34979 is an OS command injection vulnerability affecting QNAP QTS and QuTS hero operating systems. This high-severity flaw (CVSS 7.2) allows authenticated administrators to execute arbitrary commands remotely over a network, potentially leading to full compromise of the affected system. While no active exploitation, public exploit code, or significant community discussion has been observed, QNAP has released patches (QTS 4.5.4.2790 build 20240605+ and QuTS hero h4.5.4.2790 build 20240606+) to address this vulnerability.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
4.5.4.1715CPE matchmatch criteria | cpe:2.3:o:qnap:qts:4.5.4.1715:build_20210630:*:*:*:*:*:* | ||
4.5.4.1723CPE matchmatch criteria | cpe:2.3:o:qnap:qts:4.5.4.1723:build_20210708:*:*:*:*:*:* | ||
4.5.4.1741CPE matchmatch criteria | cpe:2.3:o:qnap:qts:4.5.4.1741:build_20210726:*:*:*:*:*:* | ||
4.5.4.1787CPE matchmatch criteria | cpe:2.3:o:qnap:qts:4.5.4.1787:build_20210910:*:*:*:*:*:* | ||
4.5.4.1800CPE matchmatch criteria | cpe:2.3:o:qnap:qts:4.5.4.1800:build_20210923:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.3 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.