CVE-2017-6361: QNAP QTS OS command injection allows remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

critical priorityUnauthenticated remote command execution with a CVSS score of 9.8 and publicly available exploit code makes this a critical risk for exposed QNAP QTS systems.

What it is

QNAP QTS before 4.2.4 Build 20170313 contains an OS command injection flaw (CWE-78) that lets attackers run arbitrary commands. The vulnerability is remotely reachable without authentication or user interaction, making it a serious risk for internet-exposed NAS devices.

Impact

An attacker can execute arbitrary commands on the underlying QTS operating system, typically with the privileges of the affected service, leading to full compromise of the NAS and any data or credentials it holds.

Attack surface

The CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates the flaw is reachable over the network with no authentication and no user interaction required. The description does not name the specific endpoint or parameter, so the exact entry point is unspecified.

Exploitation

CVE-2017-6361 is not listed in CISA KEV, but EPSS is high (0.56847, 99th percentile) and a public Exploit-DB entry (41842) exists, indicating exploit code is publicly available.

What to do

• Upgrade QNAP QTS to 4.2.4 Build 20170313 or later as directed by the vendor advisory.
• Remove internet-facing exposure of QTS management interfaces; restrict access to trusted networks or VPN.
• Disable or restrict unused services and remote administration features on the NAS.
• Monitor QNAP advisories for follow-up fixes and apply them promptly.
• Segment NAS devices from critical internal networks to limit lateral movement if compromised.

Detection

• Review QTS and system logs for unexpected command execution or shell activity from web-facing processes.
• Monitor for anomalous outbound connections or process spawning by QTS web services.
• Alert on access to QTS management endpoints from untrusted or external source IPs.
• Check for known exploit patterns against QTS interfaces using network or WAF signatures.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.