CVE-2023-51066 is a high severity (CVSS 8.8) authenticated remote code execution flaw in QStar Archive Solutions Release 3-0 Build 7 Patch 0. Attackers with a low privilege account can execute commands. The record names no fix, so contact QStar and tighten who holds accounts.
What's affected
The NVD record lists QStar Archive Solutions (Archive Storage Manager) Release 3-0, Build 7, Patch 0 as affected. The description says an authenticated remote code execution vulnerability allows attackers to arbitrarily execute commands.
The record names no fixed release, and the only reference is a researcher write-up on GitHub that I did not load. Check with QStar for a patched build and ask for their advisory.
CVSS for this entry is 8.8 (High) with vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.
How to check if you're exposed
Look in the product's about or system information page for the release string. A match on Release 3-0 Build 7 Patch 0 means you are in scope of the record. Since login is required, review the list of accounts on the server and remove any that are unused or shared.
Because the record lists no CWE-specific fix guidance, the most useful check is network reachability: can systems outside your storage administration network reach the QStar server's web service?
What to do now
- Identify QStar Archive Solutions servers and confirm the release, build and patch level.
- Ask QStar whether a build newer than Build 7 Patch 0 fixes this CVE, and apply it when available.
- Restrict network access to the QStar web interface and services to the administrators and systems that need them.
- Review the server's access logs and configuration for changes you did not make, then record the outcome.
- Run the free in-browser dependency scan at gold.safeguard.sh/scan against your manifests, and look the entry up in the Safeguard Gold directory to see how it is tracked.
Why it matters
CWE-94 is code injection. Input is treated as code and run by the application. The fix is to stop evaluating untrusted input, or to restrict what the evaluator is allowed to do.
The record lists CWE-94, code injection. Input is treated as code and run by the application. The NVD vector needs only a low privilege account over the network, with high impact on all three properties.
This ties into the sibling QStar entries from the same disclosure. An access control issue that hands out accounts or settings can make an authenticated flaw much easier to use, so patch the family together when a fix is available.
The record does not mark this CVE as listed in the CISA Known Exploited Vulnerabilities catalog, and no source I read reports exploitation in the wild.
Quick check
Do I need to be logged in?
Yes, the vector requires low privileges.
Are there related QStar CVEs?
The same disclosure covers CVE-2023-51063, CVE-2023-51065 and CVE-2023-51070.
Sources
Last reviewed: 19 October 2026.
