CVE-2023-39294 is a medium severity (CVSS 6.6) OS command injection in QNAP QTS and QuTS hero. An authenticated administrator can run commands over the network. QNAP fixed it in QTS 5.1.3.2578 build 20231110 and later, and QuTS hero h5.1.3.2578 build 20231110 and later.
What's affected
The NVD record scores this 6.6 (Medium) with the vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L. The affected products it lists are QNAP QTS and QuTS hero builds, including QTS 5.1.0.2348 (build 20230325), QTS 5.1.0.2399 (build 20230515), QTS 5.1.0.2418 (build 20230603) and more. The advisory wording covers several QNAP operating system versions, so treat any build older than the fixed list as exposed.
Fixed versions, as quoted in the record from the QNAP advisory: QTS 5.1.3.2578 build 20231110 and later, and QuTS hero h5.1.3.2578 build 20231110 and later. The record lists only the 5.1 series builds as affected. If you run an older release family, read the advisory for your branch.
The weakness class is CWE-78 (improper neutralization of special elements used in an OS command). The record does not mark this CVE as being in the CISA Known Exploited Vulnerabilities catalog, and nothing we could read says it is exploited in the wild.
How to check if you're exposed
Look at the firmware version on each NAS you run.
In QTS or QuTS hero, open Control Panel, then System, then Firmware Update. The installed version and build number are shown there, and the same page can check for a newer build. Compare the build against the fixed list above.
Also check how each device is reachable. A NAS whose admin interface is open to the internet, or to a flat internal network, is a larger risk than one limited to a management segment.
What to do now
- Inventory every QNAP NAS and note the QTS or QuTS hero build on each.
- Update QTS to 5.1.3.2578 build 20231110 or later, and QuTS hero to h5.1.3.2578 build 20231110 or later. Read the QNAP advisory QSA-23-54 for your model first.
- Review who holds administrator accounts on each NAS. This flaw needs an admin login, so remove unused admin accounts and enforce strong, unique credentials.
- Keep the management interface off the public internet. Reach it through a VPN or a restricted management network.
- Check the QNAP admin and system logs for unexpected command activity from admin sessions.
Why it matters
OS command injection means input from the user ends up inside a command that the operating system runs, without being cleaned first. The record says an authenticated administrator can run commands over the network. That is why the CVSS vector needs high privileges, and why the score sits at 6.6 and not higher.
The practical danger is the chain. An attacker who has stolen or guessed an admin password can use a bug like this to go from the web console to a shell on the box. A NAS often holds backups and shared files, so shell access there is worth a lot to an attacker. Patching closes the step, and limiting admin access shrinks the chance anyone gets that far.
Try it yourself
When a vendor fix exists, the work is finding every place that needs it. This demo shows how to see which findings already have a fix you can apply.
Click through it at your own pace, or open it full screen.
Quick check
Do I need an admin account for this?
Yes. The record says authenticated administrators can execute commands. It still matters because stolen admin credentials are common, and a command injection turns a web login into a shell.
Which build fixes it?
QTS 5.1.3.2578 build 20231110 and later, and QuTS hero h5.1.3.2578 build 20231110 and later, according to the record. Confirm against QNAP advisory QSA-23-54.
Sources
- QNAP security advisory QSA-23-54 (listed in the record; the page returned no readable content when we fetched it, so fixed versions here come from the NVD record, which quotes the advisory text)
- Safeguard Gold entry for CVE-2023-39294
Last reviewed: 19 October 2026.
