CVE-2023-39300 is a high severity (CVSS 7.2) OS command injection in legacy QNAP QTS, the 4.x release lines. Authenticated administrators can run commands over the network. QNAP fixed it in QTS 4.3.6.2805, 4.3.4.2814, 4.3.3.2784 and 4.2.6, all June 2024 builds.
What's affected
The NVD record scores this 7.2 (High) with the vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. The affected products it lists are QNAP QTS and QuTS hero builds, including QTS 4.3.6.0895 (build 20190328), QTS 4.3.6.0907 (build 20190409), QTS 4.3.6.0923 (build 20190425) and more. The advisory wording covers several QNAP operating system versions, so treat any build older than the fixed list as exposed.
Fixed versions, as quoted in the record from the QNAP advisory: QTS 4.3.6.2805 build 20240619 and later, QTS 4.3.4.2814 build 20240618 and later, QTS 4.3.3.2784 build 20240619 and later, and QTS 4.2.6 build 20240618 and later. This entry concerns old QTS release lines, from 2019 builds. Devices on these lines are often end of sale hardware that people forget to patch.
The weakness class is CWE-78 (improper neutralization of special elements used in an OS command). The record does not mark this CVE as being in the CISA Known Exploited Vulnerabilities catalog, and nothing we could read says it is exploited in the wild.
How to check if you're exposed
Look at the firmware version on each NAS you run.
In QTS or QuTS hero, open Control Panel, then System, then Firmware Update. The installed version and build number are shown there, and the same page can check for a newer build. Compare the build against the fixed list above.
Also check how each device is reachable. A NAS whose admin interface is open to the internet, or to a flat internal network, is a larger risk than one limited to a management segment.
What to do now
- Find every QNAP device still on QTS 4.2.x or 4.3.x. These are easy to miss because the hardware is old.
- Update to the fixed build for your branch: 4.3.6.2805 build 20240619, 4.3.4.2814 build 20240618, 4.3.3.2784 build 20240619 or 4.2.6 build 20240618. The advisory is QSA-24-26.
- If a device cannot move to a supported release, take it off any network it does not need to be on and limit admin access.
- Review administrator accounts and remove unused ones.
Why it matters
The weakness is the same class as the other QNAP command injection entries: input reaches a system command without proper neutralization. Here it sits in a legacy release line, and the record says an administrator login is required.
Legacy lines deserve a closer look than their score suggests. Old hardware tends to sit forgotten in a branch office or a lab, with an old admin password and a long uptime. The score is 7.2, but the exposure on such a box can be worse than on a current device. Updating, or retiring them, is the fix.
Quick check
Is a June 2024 fix available for such old versions?
Yes. The record quotes fixed builds dated 18 and 19 June 2024 for the 4.3.6, 4.3.4, 4.3.3 and 4.2.6 lines.
Does it need an admin login?
Yes. The record says authenticated administrators.
Sources
- QNAP security advisory QSA-24-26 (listed in the record; the page returned no readable content when we fetched it, so fixed versions here come from the NVD record, which quotes the advisory text)
- Safeguard Gold entry for CVE-2023-39300
Last reviewed: 19 October 2026.
