QNAP QTS 未授权 命令注入漏洞

Description

PoC

None yet. Search at https://trap.biu.life/?ref=rss

References

• https://stack.chaitin.com/vuldb/detail/6cead628-4378-4bb9-9a90-ff85bb3cfa63
• https://github.com/eeeeeeeeee-code/POC/blob/main/wpoc/QNAP/QNAP-QTS%E6%BA%A2%E5%87%BA%E5%AF%BC%E8%87%B4%E7%9A%84%E6%9C%AA%E6%8E%88%E6%9D%83RCE%E6%BC%8F%E6%B4%9E(CVE-2024-27130).md
• https://avd.aliyun.com/detail?id=AVD-2024-14026
• https://www.qnap.com/en/security-advisory/qsa-21-05
• https://www.rapid7.com/blog/post/2024/02/13/cve-2023-47218-qnap-qts-and-quts-hero-unauthenticated-command-injection-fixed/
• https://nvd.nist.gov/vuln/detail/CVE-2025-22481
• https://www.qnap.com/en/security-advisory/qsa-23-35
• https://www.sentinelone.com/vulnerability-database/cve-2024-50393/
• https://www.qnap.com/en-us/security-advisory/qsa-21-28
• https://nvd.nist.gov/vuln/detail/CVE-2024-53692

Related Vulnerabilities

• QNAP QTS 多款设备 /cgi-bin/priv/privWizard.cgi 权限绕过漏洞（CVE-2024-21899）
• PoCCVE-2019-7192: QNAP QTS and Photo Station 6.0.3 - Remote Command Execution
• PoCCVE-2022-27593: QNAP QTS Photo Station External Reference - Local File Inclusion
• PoCCVE-2023-47218: QNAP QTS and QuTS Hero - OS Command Injection
• QNAP QTS CVE-2023-47218 命令注入漏洞