CVE-2023-47218: Medium Command Injection in QNAP QTS and QuTS hero

CVE-2023-47218 is a command injection in QNAP QTS and QuTS hero, scored 5.8 Medium in NVD. Rapid7 describes it as unauthenticated, reachable on devices that have not been initialized. QNAP fixed it in QTS 5.1.5.2645 build 20240116, QuTS hero h5.1.5.2647 build 20240118 and QuTScloud c5.1.5.2651, and later.

What's affected

QNAP's advisory, quoted in the record, lists these fixed versions:

• QTS 5.1.5.2645 build 20240116 and later
• QuTS hero h5.1.5.2647 build 20240118 and later
• QuTScloud c5.1.5.2651 and later

The record lists QTS and QuTS hero as affected without a lower bound, and Rapid7 says QTS 5.1.x was fixed in 5.1.5.2645 and QuTS hero h5.1.x in h5.1.5.2647. Rapid7 dates the fix to 25 January 2024. I could not read QNAP's advisory directly.

The sources describe this differently. The record scores it 5.8 Medium with an adjacent network vector and high attack complexity. Rapid7's write-up calls it unauthenticated command injection in the quick.cgi component, present on a NAS that has not been initialized, where the component is disabled once setup finishes. Those fit together: the severity is moderate because of the narrow precondition, but within that condition no login is needed. Rapid7 also published a proof of concept, so details are public.

The NVD record was published on 2024-02-13, scores 5.8 (Medium), and carries the vector CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L. Weakness class: CWE-77, CWE-78.

How to check if you're exposed

Check the firmware version of each QNAP NAS.

1. Sign in to QTS or QuTS hero and open Control Panel, then System, then Firmware Update, and read the current version.
2. Compare it with the fixed versions above.
3. Confirm that every device was fully set up. A device that was installed but never initialized is the case Rapid7 describes.

Also check that no NAS administration interface is exposed to the internet, which you can test from outside your network or by reviewing firewall rules.

What to do now

1. Update QTS, QuTS hero or QuTScloud to the fixed version or later, using QNAP's firmware update process.
2. Finish initialization on any new or reset device before connecting it to a shared network.
3. Keep NAS web interfaces off the internet, and disable port forwarding and cloud features you do not use.
4. Take a backup before updating, and keep a copy that is not reachable from the NAS.
5. Review the QNAP advisory for model specific notes.

Why it matters

Command injection is CWE-78, with the related CWE-77. Input from a request ends up in a command the system shell runs. If it is not neutralized, a caller can add commands of their own.

NAS devices hold backups and shared files, and they are a frequent target for ransomware. A flaw that gives command execution on one, even under narrow conditions, deserves a prompt update. The record's KEV flag is false, so this CVE is not on the CISA Known Exploited Vulnerabilities list. Public technical detail from Rapid7 makes delay less attractive.

The provisioning component is the lesson. Setup features should be disabled after use and should not be reachable on a deployed device.

Try it yourself

Click through it at your own pace, or open it full screen.

Quick check

Sources

• Rapid7 analysis of CVE-2023-47218
• QNAP advisory QSA-23-57 (listed in the record, not readable in my fetch)

Last reviewed: 19 October 2026.