Authenticated command execution via user deletion APIs

Command injection in QNAP QTS and QuTS hero allows remote authenticated users with administrator access to execute commands on the NAS. The user deletion APIs pass attacker-controlled request data into operating-system command execution without adequate neutralization; QNAP has not disclosed the affected parameter or function. An administrator account is required, and successful exploitation enables arbitrary commands with the NAS service's privileges, including data access, modification, or service interruption.