CVE-2023-47567 is an OS command injection flaw in the operating system of QNAP's QTS, QuTS hero and QuTScloud. NVD scores it 4.7, Medium. The fixes are QTS 5.1.5.2645 build 20240116, QTS 4.5.4.2627 build 20231225, QuTS hero h5.1.5.2647 build 20240118, QuTS hero h4.5.4.2626 build 20231225, and QuTScloud c5.1.5.2651, each and later.
What's affected
The record lists QTS 4.5.4 builds from mid 2021 in its product list. QNAP's text covers both the 5.1 and the 4.5.4 lines, with a fixed build for each.
The weaknesses listed in the record: CWE-78.
The NVD vector is CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L. QNAP's advisory page needs a browser to render, so I could not read it directly. The fixed versions below come from the NVD record, which reproduces QNAP's text.
How to check if you're exposed
Open the QNAP management interface and read the version of the affected product. For the operating system, that is the Firmware Update page in Control Panel. For an app, it is the App Center entry. Compare what you see with the fixed versions listed above.
I am not giving a command line check. QNAP's own pages and the device interface are the supported route, and I could not confirm a command that works across all models.
What to do now
- Update QTS 5.1 to 5.1.5.2645 or later, or QTS 4.5 to 4.5.4.2627 build 20231225 or later.
- Update QuTS hero to h5.1.5.2647 or h4.5.4.2626 builds, or later, and QuTScloud to c5.1.5.2651 or later.
- Reduce the number of administrator accounts and protect them with strong, unique passwords.
- Keep the administration interface off the internet.
- Record firmware builds in your inventory, including older 4.5 units that are easy to forget.
Why it matters
The class is CWE-78, OS command injection, and the privilege needed is administrator, so NVD scores it 4.7, Medium, with Low impact on confidentiality, integrity and availability. It is the weakest of the QNAP command injection issues in this series, and it shares an advisory with CVE-2023-47568, a SQL injection that scores 8.8.
That pairing is a useful lesson. Two flaws on one advisory page can differ by a wide margin in severity, and teams that read only the headline can miss the one that matters. Here the SQL injection needs only a low privilege account. Updating to the fixed build deals with both at once.
For a 4.5 line device, the date matters. The 4.5.4 fix is from December 2023, and those units are on a release line that is old. If you still run 4.5, plan the move to a newer line where your hardware supports it.
Quick check
Is this the same advisory as CVE-2023-47568?
Yes. Both CVEs are covered by QNAP's QSA-24-05, and the same firmware update fixes both.
Which score is right, 4.7 or something higher?
The record scores it 4.7, Medium. Its sibling, the SQL injection, scores 8.8.
Sources
Last reviewed: 19 October 2026.
