{"id":"CVE-2023-47218","published":"2024-02-13T02:44:14Z","modified":"2025-05-07T21:13:18Z","title":"QTS, QuTS hero, QuTScloud","vendor":"QNAP Systems Inc.","product":"QTS","tier":"core","eol":null,"affectedVersions":[{"vendor":"QNAP Systems Inc.","product":"QTS","versions":[">= 5.1.x, < 5.1.5.2645 build 20240116"]},{"vendor":"QNAP Systems Inc.","product":"QuTS hero","versions":[">= h5.1.x, < h5.1.5.2647 build 20240118"]},{"vendor":"QNAP Systems Inc.","product":"QuTScloud","versions":[">= c5.x, < c5.1.5.2651"]}],"description":{"text":"An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow users to execute commands via a network.\n\nWe have already fixed the vulnerability in the following versions:\nQTS 5.1.5.2645 build 20240116 and later\nQuTS hero h5.1.5.2647 build 20240118 and later\nQuTScloud c5.1.5.2651 and later","provenance":"source","from":"CVE.org"},"summary":{"text":"An OS command injection flaw in QNAP's QTS operating system (including the QuTS hero and QuTScloud variants) allows attackers to run arbitrary commands on affected devices. Exploitation requires network access and a high-complexity condition, and it needs no privileges or user interaction.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-31T12:59:49Z"},"cvss":{"score":5.8,"severity":"MEDIUM","version":"3.1","vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.8992,"percentile":0.99791,"date":"2026-10-30","provenance":"source"},"kev":null,"vulncheckKev":{"dateAdded":"2024-02-16","exploitedFirstSeen":"2024-02-16","ransomware":false,"evidence":[{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-02-16&host_type=src&vulnerability=cve-2023-47218","date":"2024-02-16"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-02-18&host_type=src&vulnerability=cve-2023-47218","date":"2024-02-18"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-02-19&host_type=src&vulnerability=cve-2023-47218","date":"2024-02-19"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-02-20&host_type=src&vulnerability=cve-2023-47218","date":"2024-02-20"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-02-21&host_type=src&vulnerability=cve-2023-47218","date":"2024-02-21"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-02-22&host_type=src&vulnerability=cve-2023-47218","date":"2024-02-22"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-02-23&host_type=src&vulnerability=cve-2023-47218","date":"2024-02-23"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-02-26&host_type=src&vulnerability=cve-2023-47218","date":"2024-02-26"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-03-05&host_type=src&vulnerability=cve-2023-47218","date":"2024-03-05"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-03-06&host_type=src&vulnerability=cve-2023-47218","date":"2024-03-06"}],"evidenceTotal":420,"provenance":"source"},"exploited":true,"otx":{"pulseCount":7,"pulses":[{"name":"RondoDox Botnet Joins Wave of Attacks Against XWiki Vulnerability","url":"https://otx.alienvault.com/pulse/691be14e2089143e4e2e70c5","created":"2025-11-18"},{"name":"EbeeNov2025 Pt3","url":"https://otx.alienvault.com/pulse/6916aa77dacfe4a69f394336","created":"2025-11-14"},{"name":"NCSC Advisory - 18th Sept 2024 - PRC Botnet","url":"https://otx.alienvault.com/pulse/678638141cbf938dbca1090d","created":"2025-01-14"},{"name":"People's Republic of China-Linked Actors Compromise Routers and IoT Devices for Botnet Operations","url":"https://otx.alienvault.com/pulse/677cd56c6fd3f2632e1b4411","created":"2025-01-07"},{"name":"People's Republic of China-Linked Actors Compromise Routers and IoT Devices for Botnet Operations","url":"https://otx.alienvault.com/pulse/677cd54761ae1299ecfe27aa","created":"2025-01-07"},{"name":"People's Republic of China-Linked Actors Compromise Routers and IoT Devices for Botnet Operations","url":"https://otx.alienvault.com/pulse/66fd391fe0318d98f8af0eb4","created":"2024-10-02"},{"name":"CSA-PRC-LINKED-ACTORS-BOTNET","url":"https://otx.alienvault.com/pulse/66ebe08841abbc50444fbcae","created":"2024-09-19"}],"provenance":"machine"},"cwes":[{"id":"CWE-77","name":"Improper Neutralization of Special Elements used in a Command"},{"id":"CWE-78","name":"Improper Neutralization of Special Elements used in an OS Command"}],"references":[{"url":"https://www.qnap.com/en/security-advisory/qsa-23-57","tags":[]},{"url":"https://www.rapid7.com/blog/post/2024/02/13/cve-2023-47218-qnap-qts-and-quts-hero-unauthenticated-command-injection-fixed/","tags":[]}],"techniques":[],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2023-51350","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-51350","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":1,"skipped":0,"earliest":"2024-02-19","earliestUrl":"https://github.com/passwa11/CVE-2023-47218","repos":[{"name":"passwa11/CVE-2023-47218","url":"https://github.com/passwa11/CVE-2023-47218","stars":0,"created":"2024-02-19"}]},"metasploit":[{"name":"QNAP QTS and QuTS Hero Unauthenticated Remote Code Execution in quick.cgi","module":"exploit/linux/http/qnap_qts_rce_cve_2023_47218","type":"exploit","disclosureDate":"2024-02-13","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/qnap_qts_rce_cve_2023_47218.rb"}],"nuclei":[{"id":"CVE-2023-47218","name":"QNAP QTS and QuTS Hero - OS Command Injection","severity":"medium","path":"http/cves/2023/CVE-2023-47218.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-47218.yaml"}],"first":{"date":"2024-02-13","source":"Metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/qnap_qts_rce_cve_2023_47218.rb"},"provenance":"source"},"exploitRefs":[],"flow":[],"timeline":[{"date":"2024-02-13","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2023-47218","provenance":"source"},{"date":"2024-02-13","kind":"exploit-public","label":"First public exploit: Metasploit; later: PoC-in-GitHub 2024-02-19","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/qnap_qts_rce_cve_2023_47218.rb","provenance":"source"},{"date":"2024-02-16","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-02-16&host_type=src&vulnerability=cve-2023-47218","provenance":"source"}],"speed":{"daysToPublicExploit":0,"firstExploitFrom":"Metasploit","daysToKev":null},"priority":{"score":66.1,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 988 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.96,"detail":"percentile 0.9979"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 PoC-in-GitHub repo; 1 Metasploit module; 1 nuclei template"},{"name":"Mentioned in OTX pulses","points":2.05,"detail":"7 pulses"},{"name":"CVSS severity","points":4.06,"detail":"base score 5.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}