CVE-2023-39297 is a high severity (CVSS 8.8) OS command injection in QNAP QTS and QuTS hero. Any authenticated user, not only an administrator, can run commands over the network. QNAP lists fixes in the 5.1.4 and 4.5.4 branches, and in QuTScloud c5.1.5.2651.
What's affected
The NVD record scores this 8.8 (High) with the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. The affected products it lists are QNAP QTS and QuTS hero builds, including QTS 4.5.4.1715 (build 20210630), QTS 4.5.4.1723 (build 20210708), QTS 4.5.4.1741 (build 20210726). The advisory wording covers several QNAP operating system versions, so treat any build older than the fixed list as exposed.
Fixed versions, as quoted in the record from the QNAP advisory: QTS 5.1.4.2596 build 20231128 and later, QTS 4.5.4.2627 build 20231225 and later, QuTS hero h5.1.4.2596 build 20231128 and later, QuTS hero h4.5.4.2626 build 20231225 and later, and QuTScloud c5.1.5.2651 and later. The record lists QTS 4.5.4 builds from 2021 among the affected products, so older installations are in scope too.
The weakness class is CWE-78 (improper neutralization of special elements used in an OS command). The record does not mark this CVE as being in the CISA Known Exploited Vulnerabilities catalog, and nothing we could read says it is exploited in the wild.
This one is scored higher than the sibling QNAP command injection entries because the vector asks for low privileges, not high. A normal user account is enough, per the description.
How to check if you're exposed
Look at the firmware version on each NAS you run.
In QTS or QuTS hero, open Control Panel, then System, then Firmware Update. The installed version and build number are shown there, and the same page can check for a newer build. Compare the build against the fixed list above.
Also check how each device is reachable. A NAS whose admin interface is open to the internet, or to a flat internal network, is a larger risk than one limited to a management segment.
What to do now
- Inventory every QNAP device and the branch it runs (5.1.x or 4.5.x), plus any QuTScloud instances.
- Update to the fixed build for your branch: QTS 5.1.4.2596 build 20231128 or 4.5.4.2627 build 20231225, QuTS hero h5.1.4.2596 build 20231128 or h4.5.4.2626 build 20231225, or QuTScloud c5.1.5.2651. The advisory is QSA-23-30.
- Review every user account on each NAS, not just admins. Disable accounts you do not recognise and require strong passwords.
- Keep the admin and file services off the internet. Use a VPN for remote access.
- Check logs for unusual command activity tied to ordinary user sessions.
Why it matters
OS command injection happens when user supplied text is passed into a shell command without proper neutralization. The record says authenticated users can run commands via the network. Compared with the administrator only entries, the bar here is a lot lower, since any account on the box qualifies.
Many NAS devices carry large numbers of ordinary accounts for staff or guests. Each of those becomes a possible starting point. A shell on the NAS exposes the data on it and can serve as a foothold inside the network. Updating and trimming accounts are the two controls that matter.
Quick check
Do I need an administrator account to use this?
No. The record says authenticated users can execute commands, and the vector asks for low privileges. That is why the score is 8.8.
Does it affect older QTS 4.5.4 systems?
Yes. The record lists 4.5.4 builds as affected, and QNAP lists QTS 4.5.4.2627 build 20231225 as a fixed build in that branch.
Sources
- QNAP security advisory QSA-23-30 (listed in the record; the page returned no readable content when we fetched it, so fixed versions here come from the NVD record, which quotes the advisory text)
- Safeguard Gold entry for CVE-2023-39297
Last reviewed: 19 October 2026.
