New Vulnerability in QNAP QTS Firmware: CVE-2023-50358
Summary: Unit 42 researchers at Palo Alto Networks discovered a zero-day command injection vulnerability in QNAP QTS and QuTS hero firmware, tracked as CVE-2023-50358, which QNAP has acknowledged in a new security advisory. The flaw sits in the quick.cgi component, reachable without authentication, where the SPECIFIC_SERVER parameter is written to /tmp/quick/quick_tmp.conf as the NTP Address and then executed via system(), allowing arbitrary command execution.
Key Takeaway: Unit 42's telemetry found vulnerable devices across 289,665 separate IP addresses in a single week in mid-January 2024, spread across 18 top countries - a reminder that unauthenticated, internet-facing NAS appliances are being counted at scale, not in the abstract.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2023-50358
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026