CVE-2023-47566 is an OS command injection flaw in the operating system of QNAP's QTS, QuTS hero and QuTScloud. NVD scores it 6.7, Medium. The fixes are QTS 5.1.5.2645 build 20240116 and later, QuTS hero h5.1.5.2647 build 20240118 and later, and QuTScloud c5.1.5.2651 and later.
What's affected
The record lists QTS 5.1.0 builds from March, May and June 2023. QNAP's text lists the three fixed builds above. Because the record's product list shows only those 5.1.0 builds, check the advisory for the full list of affected 5.1 builds before you decide that an older build is safe.
The weaknesses listed in the record: CWE-78.
The NVD vector is CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:H. QNAP's advisory page needs a browser to render, so I could not read it directly. The fixed versions below come from the NVD record, which reproduces QNAP's text.
How to check if you're exposed
Open the QNAP management interface and read the version of the affected product. For the operating system, that is the Firmware Update page in Control Panel. For an app, it is the App Center entry. Compare what you see with the fixed versions listed above.
I am not giving a command line check. QNAP's own pages and the device interface are the supported route, and I could not confirm a command that works across all models.
What to do now
- Update QTS to 5.1.5.2645 build 20240116 or later, QuTS hero to h5.1.5.2647 build 20240118 or later, or QuTScloud to c5.1.5.2651 or later.
- Limit the number of administrator accounts, and use unique strong passwords for them.
- Turn on two step verification for administrators if your firmware offers it.
- Keep the administration interface off the internet.
- Record the firmware build of each NAS in your inventory.
Why it matters
This is CWE-78, OS command injection, in the operating system itself. The difference from the app flaws in the same series is the privilege needed. QNAP says authenticated administrators could execute commands, and the NVD vector requires High privileges (PR:H). That is why the score is 6.7, Medium, in spite of high impact ratings on confidentiality and availability.
A flaw that needs an administrator account is easy to underrate. The thinking goes: if someone has an administrator account, they can already do anything. That is only partly true. A web administrator role can be limited, and command execution on the operating system is a step beyond what the interface is meant to allow. It also matters when administrator credentials are shared, stolen or reused from another site.
The fix is a normal firmware update. The reasonable order is to patch the devices that hold the most data and have the most administrators first.
Quick check
Why is this Medium when impact is High?
The attacker needs an administrator account. That raises the privilege requirement in the NVD vector and lowers the score.
Does this also apply to QTS 4.5?
The record for this CVE lists 5.1 builds. A sibling CVE, CVE-2023-47567, covers 4.5.4 as well.
Sources
Last reviewed: 19 October 2026.
