CVE-2024-14026CWE-78

QTS, QuTS hero

Low · published March 11, 2026

CVSS v4.0
2.0
EPSS
1%
Percentile
49.8
In the wild
Unconfirmed
What it is

A command injection vulnerability has been reported to affect several QNAP operating system versions. If an attacker gains local network access who have also gained a user account, they can then exploit the vulnerability to execute arbitrary commands.

We have already fixed the vulnerability in the following versions:

QTS 5.1.9.2954 build 20241120 and later

QTS 5.2.3.3006 build 20250108 and later

QuTS hero h5.1.9.2954 build 20241120 and later

QuTS hero h5.2.3.3006 build 20250108 and later

The record
Technical detail
CVSS v4.0
2.0 · LOW
Vector
CVSS:4.0/AV:P/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U
EPSS
0.00635 · 49.8th percentile
Weakness
CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Published
2026-03-11T08:02Z
EPSS history
Timeline
  • 11 MAR 08:02Z
    QTS, QuTS hero
    cvelistv5