Skip to content
CVE PROGRAM SOURCE RECORD8.8 High

CVE-2020-25847

Command Injection Vulnerability in QTS and QuTS hero

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
twcert

Description

This command injection vulnerability allows attackers to execute arbitrary commands in a compromised application. QNAP have already fixed this vulnerability in the following versions of QTS and QuTS hero.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

QNAP Systems Inc. QTS

  • unspecified to < 4.5.1.1495affected

QNAP Systems Inc. QTS

  • unspecified to ≤ 4.4.3.1444affected

QNAP Systems Inc. QTS

  • 4.3.xunaffected
  • 4.2.xunaffected

QNAP Systems Inc. QuTS hero

  • unspecified to < h4.5.1.1491affected

References