CVE-2023-34979 is an OS command injection flaw in QNAP QTS and QuTS hero, scored 6.6 Medium. It needs an authenticated administrator and is rated Moderate by QNAP. QNAP's fix is QTS 4.5.4.2790 build 20240605 or later, or QuTS hero h4.5.4.2790 build 20240606 or later.
What's affected
Per QNAP advisory QSA-24-32, released on 7 September 2024, the affected versions are QTS 4.5.x and QuTS hero h4.5.x. The fixed versions are QTS 4.5.4.2790 build 20240605 or later and QuTS hero h4.5.4.2790 build 20240606 or later.
The flaw lets remote attackers with administrator level access run commands. Credit in the advisory goes to Tyaoo and 0x14. The scope change in the record's vector means the commands can affect more than the web interface itself.
How to check if you're exposed
Sign in to the QNAP web interface as an administrator and open Control Panel, then System, then Firmware Update, to read the installed build. Compare it with the fixed builds listed above.
If you cannot sign in, the version also shows on the device's login page and in the QNAP mobile app. For several devices, record each model, firmware branch and build date in a list. Branch matters here: QTS 5.x and QuTS hero h5.x systems are listed as not affected in the related advisory, so the problem is limited to the 4.5.x line.
What to do now
- Update QTS or QuTS hero to a fixed build. In the web interface, use Control Panel, System, Firmware Update, then Live Update, or download the file from QNAP's Download Center.
- Check your model's support status page, since older models may not receive newer branches.
- Keep the NAS off the public internet and put it behind a VPN or firewall.
- Restrict administrator accounts and review who has them.
- Take a backup before the upgrade and keep one copy offline.
Why it matters
The attacker already needs administrator rights, which explains the medium score. The risk is what an administrator could not do before: reach the operating system underneath the web interface. Command injection turns a management login into a shell.
That matters when administrator accounts are shared, reused or exposed. A stolen admin password plus this flaw gives full control of the box.
The weakness classes involved are CWE-78 (OS Command Injection). The record does not flag this CVE as listed in CISA's Known Exploited Vulnerabilities catalog, and none of the advisories I read says it is exploited in the wild. That can change, so treat the status as a snapshot.
Source conflict on severity: the record scores this CVE 6.6 Medium and QNAP rates it Moderate without a numeric score, which broadly agree. The record text and QSA-24-32 agree on the fixed builds.
Quick check
Does it need admin rights?
Yes. QNAP says authenticated administrators could run commands, and the record's vector requires high privileges.
Which builds fix it?
QTS 4.5.4.2790 build 20240605 or later, and QuTS hero h4.5.4.2790 build 20240606 or later.
Sources
Last reviewed: 19 October 2026.
