CVE-2023-34974 is an OS command injection flaw in QNAP QTS and QuTS hero, scored 8.8 High by NVD but rated Moderate by QNAP. Remote users with user level access may run commands. QNAP's fix is QTS 4.5.4.2790 build 20240605 or later, or the QuTS hero build named below.
What's affected
Per QNAP advisory QSA-24-32, released on 7 September 2024, the affected versions are QTS 4.5.x and QuTS hero h4.5.x. The fixed versions are QTS 4.5.4.2790 build 20240605 or later, and QuTS hero h4.5.4.2790 build 20240606 or later. QuTScloud, QVR and QES are not affected.
The flaw lets remote attackers with user level access run commands over the network. Credit in the advisory goes to huasheng_mangguo.
How to check if you're exposed
Sign in to the QNAP web interface as an administrator and open Control Panel, then System, then Firmware Update, to read the installed build. Compare it with the fixed builds listed above.
If you cannot sign in, the version also shows on the device's login page and in the QNAP mobile app. For several devices, record each model, firmware branch and build date in a list. Branch matters here: QTS 5.x and QuTS hero h5.x systems are listed as not affected in the related advisory, so the problem is limited to the 4.5.x line.
What to do now
- Update QTS or QuTS hero to a fixed build. In the web interface, use Control Panel, System, Firmware Update, then Live Update, or download the file from QNAP's Download Center.
- Check your model's support status page, since older models may not receive newer branches.
- Keep the NAS off the public internet and put it behind a VPN or firewall.
- Restrict administrator accounts and review who has them.
- Take a backup before the upgrade and keep one copy offline.
Why it matters
OS command injection happens when input from a user is passed to the operating system shell without being neutralized. Because NAS devices run services as a privileged account, a command that runs on the device usually controls the stored data.
NAS boxes hold backups and shared files, and they are targets because ransomware crews know it. The attack here needs a login, even a low one, so weak passwords and shared accounts matter as much as the patch.
The weakness classes involved are CWE-78 (OS Command Injection). The record does not flag this CVE as listed in CISA's Known Exploited Vulnerabilities catalog, and none of the advisories I read says it is exploited in the wild. That can change, so treat the status as a snapshot.
Source conflict on severity: NVD scores this CVE 8.8 High (network vector, low complexity, no privileges, user interaction required), while QNAP rates it Moderate in QSA-24-32 without a numeric score. Source conflict on versions: the record text lists QuTS hero h4.5.4.2626 build 20231225 as fixed, while QSA-24-32 lists QuTS hero h4.5.4.2790 build 20240606. Use the newer build from the advisory, and confirm with QNAP.
Try it yourself
When a vendor ships a fix, the useful question is which of your assets can take it today. This demo shows how to find those quickly.
Click through it at your own pace, or open it full screen.
Quick check
Is this severity High or Moderate?
Both labels exist. NVD scores 8.8 High. QNAP calls it Moderate. Use the higher figure to set urgency.
Which QuTS hero build fixes it?
The advisory says h4.5.4.2790 build 20240606 or later. The record text mentions h4.5.4.2626 build 20231225, so install the newer one.
Sources
Last reviewed: 19 October 2026.
