CVE-2023-45025: Critical OS Command Injection in QNAP QTS

CVE-2023-45025 is a critical OS command injection flaw in several QNAP operating systems, scored 9.0. QNAP fixed it in QTS 5.1.4.2596 and QTS 4.5.4.2627, with matching QuTS hero and QuTScloud builds. Update the firmware and keep the NAS off the public internet.

What's affected

The record says the flaw affects several QNAP operating system versions, and lists QTS 4.5.4 builds from 2021 among the CPE entries. The fixed versions in the record text are: QTS 5.1.4.2596 build 20231128 and later, QTS 4.5.4.2627 build 20231225 and later, QuTS hero h5.1.4.2596 build 20231128 and later, QuTS hero h4.5.4.2626 build 20231225 and later, and QuTScloud c5.1.5.2651 and later.

NVD scores the flaw 9.0, Critical, with the vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H. That is a network attack with high complexity, no privileges and a changed scope. The record was published on 2024-02-02 and cites QNAP advisory QSA-23-47.

The QNAP advisory page did not render when I fetched it, because it loads through scripts. The fixed versions above come from the advisory text as quoted in the NVD record. Read the advisory itself for the full affected list and any other branches.

The record says the flaw could let users execute commands via a network. It does not state whether a login is needed beyond the vector, which lists no privileges.

Weakness class: CWE-77 (command injection), CWE-78 (OS command injection).

How to check if you're exposed

Sign in to the NAS, open Control Panel, then System, then Firmware Update, and read the current version. Compare it with the fixed builds above for your branch: 5.1.x, 4.5.x, QuTS hero or QuTScloud.

From a shell on the device, the version is also in the system information. Then check exposure: confirm whether the NAS web interface or any QNAP service is reachable from the internet through port forwarding or the myQNAPcloud relay, since a network reachable bug is far more urgent when the device faces the internet.

What to do now

1. Inventory all QNAP devices and note the operating system and build of each.
2. Update to a fixed build: QTS 5.1.4.2596 (20231128) or later, QTS 4.5.4.2627 (20231225) or later, QuTS hero h5.1.4.2596 or h4.5.4.2626 or later, or QuTScloud c5.1.5.2651 or later.
3. Take a configuration backup and a data backup before updating, and keep a copy offline.
4. Remove router port forwards to the NAS and avoid exposing the admin interface to the internet. Use a VPN for remote access.
5. Review administrator accounts and sign-in logs after updating, and rotate admin passwords.
6. Enable automatic security updates if your change process allows it.

Why it matters

Command injection, tracked as CWE-77 and CWE-78, happens when a program passes data it did not validate into an operating system command. The attacker's input is then read as part of the command. On a NAS the service usually runs with high privileges, which explains the scope changed flag in the score.

Network storage holds backups, and attackers go after it because backups are what make recovery possible. The Critical rating comes from full loss of confidentiality, integrity and availability on the device. The high attack complexity keeps the score at 9.0 instead of higher. CVE-2023-45025 is not on the CISA Known Exploited Vulnerabilities list, and none of the pages I read says it has been exploited in the wild. That is a statement about what is recorded, not a reason to delay.

The demo below walks through checking whether a fix is available for a component you run, which is the question to ask for every item in your inventory.

Try it yourself

Click through it at your own pace, or open it full screen.

Quick check

Sources

• Gold entry for CVE-2023-45025
• QNAP advisory QSA-23-47 (page did not render when fetched; text taken from the NVD record)

Last reviewed: 19 October 2026.