Global infos:

An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated administrators to execute commands via a network. We have already fixed the vulnerability in the following versions: QTS 4.5.4.2790 build 20240605 and later QuTS hero h4.5.4.2790 build 20240606 and later

CVE Status: Analyzed

References:

[email protected]

Metrics:

Attribute	Value
Attack Complexity	LOW
Attack Vector	NETWORK
Availability Impact	LOW
Base Score	6.6
Base Severity	MEDIUM
Confidentiality Impact	LOW
Integrity Impact	LOW
Privileges Required	HIGH
Scope	CHANGED
User Interaction	NONE
Vector String	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L
Exploitability Score	2.3
Impact Score	3.7
Source	[email protected]
Type	Secondary

Links:

Exploit-db
Github