CVE-2024-50393

CRITICAL

A command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote attackers to execute arbitrary commands. We...

Affects 2 products across 1 vendor.

BCS7.66
CVSS 3.19.8
CVSS v48.7
EPSS1.3%
Percentile69th
PatchPatched
CVSS Vector — Plain English Remotely exploitable over the network, low complexity, no authentication required, no user interaction needed, impact contained to the vulnerable component, full confidentiality impact, full integrity impact, full availability impact.
CWE Weakness Definitions
CWE-78: OS Command Injection

Attacker injects OS commands through application inputs passed to system() or equivalent calls, leading to arbitrary command execution.

Related Attack Patterns (CAPEC)
CAPEC-43 Exploiting Multiple Input Interpretation Layers
via CWE-78
CAPEC-108 Command Line Execution through SQL Injection
via CWE-78
CAPEC-6 Argument Injection
via CWE-78
CAPEC-15 Command Delimiters
via CWE-78
CAPEC-88 OS Command Injection
via CWE-78

Mapping is CWE-to-CAPEC per MITRE CAPEC 3.9.

◆ SAGE Intelligence — CITED Relevance Research Team

A command injection vulnerability affects several QNAP operating system versions, allowing remote attackers to execute arbitrary commands.

BSID: BS-2024-GLOBAL-218873-C • Model: /workspace/models/qwen2.5-coder-32b-instruct-bf16 • Confidence: HIGH

Is this CVE in your environment?

BreachSpider monitors your ICS/OT environment for vulnerabilities like this one. No agents or network access required. Free to start.

Check My Environment →
Frequently Asked Questions
What is CVE-2024-50393?
A command injection vulnerability affects several QNAP operating system versions, allowing remote attackers to execute arbitrary commands.
What is the CVSS score for CVE-2024-50393?
CVE-2024-50393 has CVSS 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS: 1.3%.
Is CVE-2024-50393 actively exploited?
No confirmed active exploitation of CVE-2024-50393 as of 2026-05-30.
How do I remediate CVE-2024-50393?
Priority: IMMEDIATE. Advisory: https://www.qnap.com/en/security-advisory/qsa-24-49 PSIRT: [email protected]
What systems are affected by CVE-2024-50393?
CVE-2024-50393 affects: Qnap, Qnap.
Vulnerability Details
CVE IDCVE-2024-50393
BSIDBS-2024-GLOBAL-218873-C BreachSpider Global ID
CVSS VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Published2024-12-06
Last Modified2025-09-23
ICS Relevance70%
Weakness (CWE)
OS Command Injection
SourceNVD
Official Description

A command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote attackers to execute arbitrary commands. We have already fixed the vulnerability in the following versions: QTS 5.1.9.2954 build 20241120 and later QTS 5.2.2.2950 build 20241114 and later QuTS hero h5.1.9.2954 build 20241120 and later QuTS hero h5.2.2.2952 build 20241116 and later

Source: NIST NVD / MITRE CVE Database

Attack Vector Analysis — CITED Relevance

The vulnerability is a command injection flaw that can be exploited by remote attackers to execute arbitrary commands on affected QNAP systems.

Exploitation Likelihood: CRITICAL

Affected Products
VendorProductFixed Version
Qnap Qts —
Qnap Quts Hero —
Remediation
View Vendor Advisory →

Remediation Priority: IMMEDIATE

Vendor PSIRT: [email protected]
Threat Intelligence
● Threat Intelligence Validated: August 2026 | Threat Age: 621 Days
CISA KEVNot in KEV catalog
Public ExploitNot confirmed
PoC CodeNot confirmed
SAGE Enrichment Record — provenance & audit hash
Model/workspace/models/qwen2.5-coder-32b-instruct-bf16
ConfidenceHIGH
Enriched At2026-05-24
SHA-512 Audit Hash8aab5e772dbaa1fadbe6faaaf8e17e11b088a236915af4d49859df479e8af882a423d6c3708dfaa855776a50b59880ce1b1e6889affd601abbbbf943d4c462a8
Related CVEs affecting Qnap
CVE-2017-7876 10.0 This command injection vulnerability in QTS allows attackers to run arbitrary... CVE-2024-32766 10.0 An OS command injection vulnerability has been reported to affect several QNA... CVE-2024-32764 9.9 A missing authentication for critical function vulnerability has been reporte... CVE-2024-21899 9.8 An improper authentication vulnerability has been reported to affect several ... CVE-2024-48862 9.8 A link following vulnerability has been reported to affect QuLog Center. If e...
View all Qnap CVEs →

Critical Severity - Know Your Exposure

A CVSS 9.8 vulnerability in your ICS environment cannot wait. BreachSpider maps critical CVEs to your specific assets and tells you what to fix first.

Check Your Assets Free →