CVE-2023-34980 is an OS command injection flaw in QNAP QTS, QuTS hero and QuTScloud c5.0.x, scored 5.9 Medium. It needs an authenticated administrator. QNAP's fix is QTS 4.5.4.2627 build 20231225 or later, or QuTS hero h4.5.4.2626 build 20231225 or later.
What's affected
Per QNAP advisory QSA-24-12, the affected versions are QTS 4.5.x, QuTS hero h4.5.x and QuTScloud c5.0.x. QTS 5.x, QuTS hero h5.x and QuTScloud c5.1.x are not affected.
The fixed versions are QTS 4.5.4.2627 build 20231225 or later, QuTS hero h4.5.4.2626 build 20231225 or later and, for QuTScloud c5.0.x, c5.1.0.2498 build 20230822 or later. The record lists the QTS and QuTS hero builds but not the QuTScloud one. The advisory status is Resolved.
How to check if you're exposed
Sign in to the QNAP web interface as an administrator and open Control Panel, then System, then Firmware Update, to read the installed build. Compare it with the fixed builds listed above.
If you cannot sign in, the version also shows on the device's login page and in the QNAP mobile app. For several devices, record each model, firmware branch and build date in a list. Branch matters here: QTS 5.x and QuTS hero h5.x systems are listed as not affected in the related advisory, so the problem is limited to the 4.5.x line.
What to do now
- Update QTS or QuTS hero to a fixed build. In the web interface, use Control Panel, System, Firmware Update, then Live Update, or download the file from QNAP's Download Center.
- Check your model's support status page, since older models may not receive newer branches.
- Keep the NAS off the public internet and put it behind a VPN or firewall.
- Restrict administrator accounts and review who has them.
- Take a backup before the upgrade and keep one copy offline.
Why it matters
Authenticated administrators could run commands through the network. The record's vector includes user interaction and a scope change, which means the effect reaches past the vulnerable component, and which also explains the medium score.
The practical risk is small for well protected boxes and large for shared admin accounts. The simplest control is to keep the number of administrators low and the management interface off the internet.
The weakness classes involved are CWE-78 (OS Command Injection). The record does not flag this CVE as listed in CISA's Known Exploited Vulnerabilities catalog, and none of the advisories I read says it is exploited in the wild. That can change, so treat the status as a snapshot.
Source conflict on versions: the record lists only the QTS and QuTS hero fixes, while QSA-24-12 also lists QuTScloud c5.1.0.2498 build 20230822 for c5.0.x systems. Severity: the record scores 5.9 Medium and QNAP rates the advisory Moderate, which broadly agree.
Quick check
Are QTS 5.x systems affected?
No. QSA-24-12 lists QTS 5.x, QuTS hero h5.x and QuTScloud c5.1.x as not affected.
What fixes QuTScloud c5.0.x?
QNAP lists c5.1.0.2498 build 20230822 or later.
Sources
Last reviewed: 19 October 2026.
