Vulnerability-Lookup

CNVD-2025-27834

Vulnerability from cnvd - Published: 2025-11-12

Title

QNAP QTS和QuTS hero操作系统命令注入漏洞（CNVD-2025-27834）

Description

QNAP QTS是威联通科技（QNAPSystems,Inc.）开发的NAS操作系统，专为网络附加存储设备设计，提供数据管理、备份、多媒体娱乐等功能。QNAP QuTS hero是威联通（QNAP）为其网络存储设备（NAS）开发的一款企业级操作系统，它基于强大的ZFS文件系统构建，专为需要高数据完整性、安全性和高效能的应用场景设计‌。 QNAP QTS和QuTS hero存在操作系统命令注入漏洞，目前没有详细的漏洞细节提供。

Severity

中

Patch Name

QNAP QTS和QuTS hero操作系统命令注入漏洞（CNVD-2025-27834）的补丁

Patch Description

Formal description

目前厂商已经发布了QTS 5.1.6.2722 build 20240402及其以后版本和QuTS hero h5.1.6.2734 build 20240414及其以后版本以修复这个安全问题，请及时关注更新： https://www.qnap.com/en/security-advisory/qsa-24-20

Reference

https://nvd.nist.gov/vuln/detail/CVE-2024-21903

Impacted products

Name
['QNAP QTS 5.1.', 'QNAP QuTS hero h5.1.']

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2024-21903",
      "cveUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-21903"
    }
  },
  "description": "QNAP QTS\u662f\u5a01\u8054\u901a\u79d1\u6280\uff08QNAPSystems,Inc.\uff09\u5f00\u53d1\u7684NAS\u64cd\u4f5c\u7cfb\u7edf\uff0c\u4e13\u4e3a\u7f51\u7edc\u9644\u52a0\u5b58\u50a8\u8bbe\u5907\u8bbe\u8ba1\uff0c\u63d0\u4f9b\u6570\u636e\u7ba1\u7406\u3001\u5907\u4efd\u3001\u591a\u5a92\u4f53\u5a31\u4e50\u7b49\u529f\u80fd\u3002QNAP QuTS hero\u662f\u5a01\u8054\u901a\uff08QNAP\uff09\u4e3a\u5176\u7f51\u7edc\u5b58\u50a8\u8bbe\u5907\uff08NAS\uff09\u5f00\u53d1\u7684\u4e00\u6b3e\u4f01\u4e1a\u7ea7\u64cd\u4f5c\u7cfb\u7edf\uff0c\u5b83\u57fa\u4e8e\u5f3a\u5927\u7684ZFS\u6587\u4ef6\u7cfb\u7edf\u6784\u5efa\uff0c\u4e13\u4e3a\u9700\u8981\u9ad8\u6570\u636e\u5b8c\u6574\u6027\u3001\u5b89\u5168\u6027\u548c\u9ad8\u6548\u80fd\u7684\u5e94\u7528\u573a\u666f\u8bbe\u8ba1\u200c\u3002\n\nQNAP QTS\u548cQuTS hero\u5b58\u5728\u64cd\u4f5c\u7cfb\u7edf\u547d\u4ee4\u6ce8\u5165\u6f0f\u6d1e\uff0c\u76ee\u524d\u6ca1\u6709\u8be6\u7ec6\u7684\u6f0f\u6d1e\u7ec6\u8282\u63d0\u4f9b\u3002",
  "formalWay": "\u76ee\u524d\u5382\u5546\u5df2\u7ecf\u53d1\u5e03\u4e86QTS 5.1.6.2722 build 20240402\u53ca\u5176\u4ee5\u540e\u7248\u672c\u548cQuTS hero h5.1.6.2734 build 20240414\u53ca\u5176\u4ee5\u540e\u7248\u672c\u4ee5\u4fee\u590d\u8fd9\u4e2a\u5b89\u5168\u95ee\u9898\uff0c\u8bf7\u53ca\u65f6\u5173\u6ce8\u66f4\u65b0\uff1a \r\nhttps://www.qnap.com/en/security-advisory/qsa-24-20",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2025-27834",
  "openTime": "2025-11-12",
  "patchDescription": "QNAP QTS\u662f\u5a01\u8054\u901a\u79d1\u6280\uff08QNAPSystems,Inc.\uff09\u5f00\u53d1\u7684NAS\u64cd\u4f5c\u7cfb\u7edf\uff0c\u4e13\u4e3a\u7f51\u7edc\u9644\u52a0\u5b58\u50a8\u8bbe\u5907\u8bbe\u8ba1\uff0c\u63d0\u4f9b\u6570\u636e\u7ba1\u7406\u3001\u5907\u4efd\u3001\u591a\u5a92\u4f53\u5a31\u4e50\u7b49\u529f\u80fd\u3002QNAP QuTS hero\u662f\u5a01\u8054\u901a\uff08QNAP\uff09\u4e3a\u5176\u7f51\u7edc\u5b58\u50a8\u8bbe\u5907\uff08NAS\uff09\u5f00\u53d1\u7684\u4e00\u6b3e\u4f01\u4e1a\u7ea7\u64cd\u4f5c\u7cfb\u7edf\uff0c\u5b83\u57fa\u4e8e\u5f3a\u5927\u7684ZFS\u6587\u4ef6\u7cfb\u7edf\u6784\u5efa\uff0c\u4e13\u4e3a\u9700\u8981\u9ad8\u6570\u636e\u5b8c\u6574\u6027\u3001\u5b89\u5168\u6027\u548c\u9ad8\u6548\u80fd\u7684\u5e94\u7528\u573a\u666f\u8bbe\u8ba1\u200c\u3002\r\n\r\nQNAP QTS\u548cQuTS hero\u5b58\u5728\u64cd\u4f5c\u7cfb\u7edf\u547d\u4ee4\u6ce8\u5165\u6f0f\u6d1e\uff0c\u76ee\u524d\u6ca1\u6709\u8be6\u7ec6\u7684\u6f0f\u6d1e\u7ec6\u8282\u63d0\u4f9b\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "QNAP QTS\u548cQuTS hero\u64cd\u4f5c\u7cfb\u7edf\u547d\u4ee4\u6ce8\u5165\u6f0f\u6d1e\uff08CNVD-2025-27834\uff09\u7684\u8865\u4e01",
  "products": {
    "product": [
      "QNAP QTS 5.1.*",
      "QNAP QuTS hero h5.1.*"
    ]
  },
  "referenceLink": "https://nvd.nist.gov/vuln/detail/CVE-2024-21903",
  "serverity": "\u4e2d",
  "submitTime": "2024-09-11",
  "title": "QNAP QTS\u548cQuTS hero\u64cd\u4f5c\u7cfb\u7edf\u547d\u4ee4\u6ce8\u5165\u6f0f\u6d1e\uff08CNVD-2025-27834\uff09"
}

CVE-2024-21903 (GCVE-0-2024-21903)

Vulnerability from cvelistv5 – Published: 2024-09-06 16:26 – Updated: 2024-09-06 17:27

Title

QTS, QuTS hero

Summary

An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated administrators to execute commands via a network. We have already fixed the vulnerability in the following versions: QTS 5.1.6.2722 build 20240402 and later QuTS hero h5.1.6.2734 build 20240414 and later

Severity

6.6 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-09-06 17:27 UTC

CWE

Assigner

qnap mitre root

References

1 reference

URL	Tags
https://www.qnap.com/en/security-advisory/qsa-24-20

Impacted products

2 products

Vendor	Product	Version
QNAP Systems Inc.	QTS	Affected: 5.1.x , < 5.1.6.2722 build 20240402 (custom)
QNAP Systems Inc.	QuTS hero	Affected: h5.1.x , < h5.1.6.2734 build 20240414 (custom)

Credits

Thomas Fady

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-21903",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-06T17:27:38.052406Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-06T17:27:44.415Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "QTS",
          "vendor": "QNAP Systems Inc.",
          "versions": [
            {
              "lessThan": "5.1.6.2722 build 20240402",
              "status": "affected",
              "version": "5.1.x",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "QuTS hero",
          "vendor": "QNAP Systems Inc.",
          "versions": [
            {
              "lessThan": "h5.1.6.2734 build 20240414",
              "status": "affected",
              "version": "h5.1.x",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Thomas Fady"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated administrators to execute commands via a network.\u003cbr\u003e\u003cbr\u003eWe have already fixed the vulnerability in the following versions:\u003cbr\u003eQTS 5.1.6.2722 build 20240402 and later\u003cbr\u003eQuTS hero h5.1.6.2734 build 20240414 and later\u003cbr\u003e"
            }
          ],
          "value": "An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated administrators to execute commands via a network.\n\nWe have already fixed the vulnerability in the following versions:\nQTS 5.1.6.2722 build 20240402 and later\nQuTS hero h5.1.6.2734 build 20240414 and later"
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-88",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-88"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 6.6,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "HIGH",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-77",
              "description": "CWE-77",
              "lang": "en",
              "type": "CWE"
            },
            {
              "cweId": "CWE-78",
              "description": "CWE-78",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-09-06T16:26:27.970Z",
        "orgId": "2fd009eb-170a-4625-932b-17a53af1051f",
        "shortName": "qnap"
      },
      "references": [
        {
          "url": "https://www.qnap.com/en/security-advisory/qsa-24-20"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "We have already fixed the vulnerability in the following versions:\u003cbr\u003eQTS 5.1.6.2722 build 20240402 and later\u003cbr\u003eQuTS hero h5.1.6.2734 build 20240414 and later\u003cbr\u003e"
            }
          ],
          "value": "We have already fixed the vulnerability in the following versions:\nQTS 5.1.6.2722 build 20240402 and later\nQuTS hero h5.1.6.2734 build 20240414 and later"
        }
      ],
      "source": {
        "advisory": "QSA-24-20",
        "discovery": "EXTERNAL"
      },
      "title": "QTS, QuTS hero",
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "2fd009eb-170a-4625-932b-17a53af1051f",
    "assignerShortName": "qnap",
    "cveId": "CVE-2024-21903",
    "datePublished": "2024-09-06T16:26:27.970Z",
    "dateReserved": "2024-01-03T02:31:17.843Z",
    "dateUpdated": "2024-09-06T17:27:44.415Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.