CVE-2023-39302 is a medium severity (CVSS 6.6) OS command injection in QNAP QTS and QuTS hero. Authenticated administrators can run commands over the network. QNAP fixed it in QTS 5.1.3.2578 build 20231110 and later, QuTS hero h5.1.3.2578, and QuTScloud c5.1.5.2651.
What's affected
The NVD record scores this 6.6 (Medium) with the vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L. The affected products it lists are QNAP QTS and QuTS hero builds, including QTS 5.1.0.2348 (build 20230325), QTS 5.1.0.2399 (build 20230515), QTS 5.1.0.2418 (build 20230603). The advisory wording covers several QNAP operating system versions, so treat any build older than the fixed list as exposed.
Fixed versions, as quoted in the record from the QNAP advisory: QTS 5.1.3.2578 build 20231110 and later, QuTS hero h5.1.3.2578 build 20231110 and later, and QuTScloud c5.1.5.2651 and later. This is a separate CVE from CVE-2023-39294, which has the same fixed QTS and QuTS hero builds but a different advisory.
The weakness class is CWE-78 (improper neutralization of special elements used in an OS command). The record does not mark this CVE as being in the CISA Known Exploited Vulnerabilities catalog, and nothing we could read says it is exploited in the wild.
How to check if you're exposed
Look at the firmware version on each NAS you run.
In QTS or QuTS hero, open Control Panel, then System, then Firmware Update. The installed version and build number are shown there, and the same page can check for a newer build. Compare the build against the fixed list above.
Also check how each device is reachable. A NAS whose admin interface is open to the internet, or to a flat internal network, is a larger risk than one limited to a management segment.
What to do now
- Inventory QNAP devices, including any QuTScloud virtual machines.
- Update QTS to 5.1.3.2578 build 20231110 or later, QuTS hero to h5.1.3.2578 build 20231110 or later, and QuTScloud to c5.1.5.2651 or later. The advisory is QSA-23-33.
- Audit administrator accounts and remove those you do not need.
- Keep admin interfaces on a management network or behind a VPN.
Why it matters
OS command injection lets input from a user reach a command run by the operating system. The record notes that the attacker must be an authenticated administrator, so the first requirement is an admin session.
The CVSS vector marks the scope as changed, which reflects that a command run on the NAS can affect components beyond the web console. The impact on confidentiality, integrity and availability is rated low individually, which is why the total is medium. That is a good reason to patch on the normal schedule and also to tighten who holds admin rights. On shared storage, even a medium bug in the admin path is worth closing.
Quick check
Why is the score medium when it allows command execution?
The vector requires high privileges and rates each impact as low. The result is 6.6, a medium score.
Is QuTScloud affected?
The record lists a fixed QuTScloud build, c5.1.5.2651, so it is part of the advisory.
Sources
- QNAP security advisory QSA-23-33 (listed in the record; the page returned no readable content when we fetched it, so fixed versions here come from the NVD record, which quotes the advisory text)
- Safeguard Gold entry for CVE-2023-39302
Last reviewed: 19 October 2026.
