CVE-2023-41281 is a medium severity (CVSS 5.5) OS command injection in QNAP QTS, QuTS hero and QuTScloud. An authenticated administrator could run commands over the network. The fix is QTS 5.1.4.2596 build 20231128 or later, or the matching QuTS hero and QuTScloud builds.
What's affected
The NVD record describes the flaw this way: "An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated administrators to execute commands via a network." QNAP lists the fixed versions in advisory QSA-23-53 as QTS 5.1.4.2596 build 20231128 and later, QuTS hero h5.1.4.2596 build 20231128 and later, and QuTScloud c5.1.5.2651 and later.
The NVD product data names QTS 5.1.0 builds (2348, 2399 and 2418), and the description says "several QNAP operating system versions". Treat QTS, QuTS hero and QuTScloud releases older than the fixed builds as affected until QNAP says otherwise. It is one of three command injection CVEs in advisory QSA-23-53 (the others are CVE-2023-41282, CVE-2023-41283). The records share one description.
QNAP's site blocked our automated request, so this post relies on the record's own text for the version list. Check the advisory for the full table.
The record scores the flaw 5.5 (Medium) with the vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N. It can be reached over the network, the attack complexity is low, it requires high privileges (an administrator account), and it needs no user interaction. The impact on confidentiality is low, on integrity low and on availability no. The scope is marked as changed, meaning the damage can reach beyond the vulnerable component. The weakness classes are CWE-77 (command injection) and CWE-78 (OS command injection). The record does not mark this CVE as being in the CISA Known Exploited Vulnerabilities catalog, and nothing we read says it is exploited in the wild.
How to check if you're exposed
Sign in to the QTS or QuTS hero admin interface and open the firmware update page to see the installed version and build number. Compare it with the fixed builds above. For QuTScloud, check the version of the cloud instance the same way.
Then check who holds an administrator account on the device. The record says exploitation needs an authenticated administrator, so the number of admin accounts and their password hygiene are the practical measure of exposure.
What to do now
- Update the device to a fixed build: QTS 5.1.4.2596 build 20231128 and later, QuTS hero h5.1.4.2596 build 20231128 and later, and QuTScloud c5.1.5.2651 and later.
- Read QNAP advisory QSA-23-53 for any steps the record does not include.
- Reduce the number of administrator accounts and give each a strong, unique password, with two step verification where available.
- Keep the admin interface off the public internet; reach it through a VPN or an allow list.
Why it matters
The weakness classes are CWE-77 and CWE-78, command injection. Input from a request ends up in a command that the operating system runs, without enough checking, so the caller can change what the command does. The record says the caller must be an authenticated administrator.
The score is medium because of that admin requirement, but the scope is marked as changed in the vector, which means the damage can extend past the vulnerable component. Admin accounts on network storage devices deserve the same care as any other privileged credential.
Quick check
Do I need to be an administrator to trigger this?
The record says the attacker is an authenticated administrator. That lowers the score, but admin accounts are a common target, so still update.
Which builds fix it?
QTS 5.1.4.2596 build 20231128 and later, QuTS hero h5.1.4.2596 build 20231128 and later, and QuTScloud c5.1.5.2651 and later. Confirm in QSA-23-53.
Sources
- QNAP advisory QSA-23-53 (linked from the NVD record; access was blocked when we reviewed it)
- CVE-2023-41281 on Gold
Last reviewed: 19 October 2026.
