CVE-2023-41289 is a medium severity (CVSS 6.3) OS command injection flaw in QcalAgent, a QNAP app. An authenticated user could execute commands over the network. QNAP says it is fixed in QcalAgent 1.1.8 and later, so update the app and read advisory QSA-23-34.
What's affected
QNAP lists the fix in advisory QSA-23-34. The record says the flaw could allow authenticated users to execute commands via a network and that it is fixed in QcalAgent 1.1.8 and later. Earlier versions are therefore affected.
QNAP's site blocked our automated request, so the version information comes from the NVD record. The record does not describe what QcalAgent does beyond naming it as a QNAP application, and we did not find more in the sources we could read, so this post stays with what the record states.
The record scores the flaw 6.3 (Medium) with the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L. It can be reached over the network, the attack complexity is low, it requires low privileges, and it needs no user interaction. The impact on confidentiality is low, on integrity low and on availability low. The weakness class is CWE-78 (OS command injection). The record does not mark this CVE as being in the CISA Known Exploited Vulnerabilities catalog, and nothing we read says it is exploited in the wild.
How to check if you're exposed
Open the App Center on the QNAP device and look for QcalAgent in the installed apps list. Read its version and compare it with 1.1.8. If it is not installed, this CVE does not apply to you.
The record says the attacker is an authenticated user, not necessarily an administrator, so look at how many ordinary accounts the device has.
What to do now
- Update QcalAgent to 1.1.8 or later.
- If you do not use it, uninstall QcalAgent.
- Read QNAP advisory QSA-23-34 for the details.
- Review user accounts on the device and remove those that are not needed.
Why it matters
The weakness is CWE-78, OS command injection. Request data is passed to a system command without strict checks, so the caller can alter the command. The vector shows low privileges, no user interaction and a low impact on all three areas.
The score is moderate because the impact is bounded, but the requirement is only a standard user account. On shared devices that is a low bar, so the update is worth doing. If the app is not needed, removing it is the simplest fix, because an app that is not installed cannot be attacked.
Quick check
Do I need admin rights to exploit it?
No. The record says authenticated users, and the vector shows low privileges.
Which version is fixed?
QcalAgent 1.1.8 and later.
Sources
- QNAP advisory QSA-23-34 (linked from the NVD record; access was blocked when we reviewed it)
- CVE-2023-41289 on Gold
Last reviewed: 19 October 2026.
