CVE-2024-21900

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

An injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated users to execute commands via a network.

We have already fixed the vulnerability in the following versions: QTS 5.1.3.2578 build 20231110 and later QuTS hero h5.1.3.2578 build 20231110 and later QuTScloud c5.1.5.2651 and later

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-74

Affected software

Vendor	Product	Versions
QNAP Systems Inc.	QTS	>= 5.1.x, < 5.1.3.2578 build 20231110
QNAP Systems Inc.	QuTS hero	>= h5.1.x, < h5.1.3.2578 build 20231110
QNAP Systems Inc.	QuTScloud	>= c5.x.x, < c5.1.5.2651
qnap	qts	>= 5.1.x, < 5.1.3.2578 build 20231110
qnap	quts_hero	>= h5.1.x, < h5.1.3.2578 build 20231110
qnap	qutscloud	>= c5.x.x, < c5.1.5.2651

References

https://www.qnap.com/en/security-advisory/qsa-24-09Vendor Advisory
https://www.qnap.com/en/security-advisory/qsa-24-09Vendor Advisory

Timeline

Published: Mar 8, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-219014.7A SQL injection vulnerability has been reported to affect myQNAPcloud. If exploited, the vulnerability could allow authenticated administrat CVE-2024-219028.1An incorrect permission assignment for critical resource vulnerability has been reported to affect several QNAP operating system versions. I CVE-2024-219034.7An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability co CVE-2024-219046.5A path traversal vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could all CVE-2024-219058.2An integer overflow or wraparound vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulner CVE-2024-219064.7An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability co CVE-2024-219077.5Newtonsoft.Json before version 13.0.1 is affected by a mishandling of exceptional conditions vulnerability. Crafted data that is passed to t CVE-2024-219086.1TinyMCE versions before 5.9.0 are affected by a stored cross-site scripting vulnerability. An unauthenticated and remote attacker could inse CVE-2024-219097.5PeterO.Cbor versions 4.0.0 through 4.5.0 are vulnerable to a denial of service vulnerability. An attacker may trigger the denial of service CVE-2024-21915.3An issue was discovered in GitLab CE/EE affecting all versions starting from 16.9 prior to 16.11.5, starting from 17.0 prior to 17.0.3, and CVE-2024-219106.1TinyMCE versions before 5.10.0 are affected by a cross-site scripting vulnerability. A remote and unauthenticated attacker could introduce c CVE-2024-219116.1TinyMCE versions before 5.6.0 are affected by a stored cross-site scripting vulnerability. An unauthenticated and remote attacker could inse