CVE-2023-39294

HighCVSS 7.2/10Last modified Jun 17, 2026

Description

An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated administrators to execute commands via a network.

We have already fixed the vulnerability in the following versions: QTS 5.1.3.2578 build 20231110 and later QuTS hero h5.1.3.2578 build 20231110 and later

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

No affected versions have been published.

Timeline

Published
Jan 5, 2024
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-392958.8An OS command injection vulnerability has been reported to affect QuMagie. If exploited, the vulnerability could allow authenticated users tCVE-2023-392967.5A prototype pollution vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability coulCVE-2023-392978.8An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability coCVE-2023-392987.8A missing authorization vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability coCVE-2023-392997.5A path traversal vulnerability has been reported to affect Music Station. If exploited, the vulnerability could allow users to read the contCVE-2023-393007.2An OS command injection vulnerability has been reported to affect legacy QTS. If exploited, the vulnerability could allow authenticated admiCVE-2023-393014.3A server-side request forgery (SSRF) vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulCVE-2023-393027.2An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability coCVE-2023-393039.8An improper authentication vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerabilityCVE-2023-393055.3Missing Authorization vulnerability in Dash Labs Yet Another Stars Rating yet-another-stars-rating allows Exploiting Incorrectly Configured CVE-2023-393067.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeFusion Fusion Builder allows ReflCVE-2023-393078.8Unrestricted Upload of File with Dangerous Type vulnerability in ThemeFusion Avada.This issue affects Avada: from n/a through 7.11.1.
CVE-2023-39294: High severity, CVSS 7.2 | Vulnix