CVE-2023-47568 is a SQL injection flaw in the operating system of QNAP's QTS, QuTS hero and QuTScloud. NVD scores it 8.8, High. The fixes are QTS 5.1.5.2645 build 20240116, QTS 4.5.4.2627 build 20231225, QuTS hero h5.1.5.2647 build 20240118, QuTS hero h4.5.4.2626 build 20231225, and QuTScloud c5.1.5.2651, each and later.
What's affected
The record lists QTS 4.5.4 builds from mid 2021 in its product list. QNAP's text covers the 5.1 and 4.5.4 lines for QTS and QuTS hero, plus QuTScloud.
The weaknesses listed in the record: CWE-89.
The NVD vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. QNAP's advisory page needs a browser to render, so I could not read it directly. The fixed versions below come from the NVD record, which reproduces QNAP's text.
How to check if you're exposed
Open the QNAP management interface and read the version of the affected product. For the operating system, that is the Firmware Update page in Control Panel. For an app, it is the App Center entry. Compare what you see with the fixed versions listed above.
I am not giving a command line check. QNAP's own pages and the device interface are the supported route, and I could not confirm a command that works across all models.
What to do now
- Update QTS 5.1 to 5.1.5.2645 or later, or QTS 4.5 to 4.5.4.2627 build 20231225 or later.
- Update QuTS hero to h5.1.5.2647 or h4.5.4.2626 builds, or later, and QuTScloud to c5.1.5.2651 or later.
- Review accounts on each NAS, and disable those you do not need. This flaw needs only a signed-in user.
- Keep the administration interface off the internet and use a VPN.
- Record firmware builds in your inventory.
Why it matters
This is CWE-89, SQL injection, in the operating system itself. QNAP says authenticated users, not just administrators, could inject malicious code over the network. The NVD vector asks for Low privileges, which is why this one scores 8.8, High, while the command injection on the same advisory scores 4.7.
SQL injection comes from building a database query by joining text, so the database cannot tell data from instructions. The fix is parameterised queries. For an operating system component, a flaw like this is more than a data leak: the impact ratings in the vector are High for confidentiality, integrity and availability.
The wider point for owners of a NAS is account hygiene. Any user with a login is a potential starting point. Remove accounts that are old, disable shared accounts, and make sure the ones that remain use strong passwords. Then update.
Quick check
Does this need an administrator account?
No. QNAP says authenticated users could exploit it, and NVD's vector requires Low privileges.
Is this fixed by the same update as CVE-2023-47567?
Yes. Both are covered by QNAP's advisory QSA-24-05.
Sources
Last reviewed: 19 October 2026.
