vulnerability

QNAP QTS: CVE-2023-47218: Improper Neutralization of Special Elements used in a Command

Try Surface Command

Back to search

Severity

CVSS

(AV:A/AC:H/Au:N/C:P/I:P/A:P)

Published

Feb 13, 2024

Added

Apr 17, 2025

Modified

Feb 26, 2026

Description

An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow users to execute commands via a network.

Solution

qnap-qts-upgrade-latest

References

CVE-2023-47218
https://attackerkb.com/topics/CVE-2023-47218
https://www.qnap.com/en/security-advisory/qsa-23-57
https://www.rapid7.com/blog/post/2024/02/13/cve-2023-47218-qnap-qts-and-quts-hero-unauthenticated-command-injection-fixed/

Rapid7 Labs

2026 Global Threat Landscape Report

The predictive window has collapsed. Exploitation follows disclosure in days. See how attackers are accelerating and how to stay ahead.

Get report