An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow users to execute commands via a network. The vulnerability exists due to the lack of measures to neutralize special elements used in the operating system command. Researchers detected vulnerable devices from 289,665 separate IP addresses. The vulnerability is related to the Quick.cgi file and can be exploited by sending a request to the "/cgi-bin/quick/quick.cgi" endpoint. The `todo` parameter, specifically the `set timeinfo` value, and the `SPECIFIC SERVER` variable are involved in the exploitation. The vulnerability allows an attacker to execute arbitrary commands, potentially leading to a remote code execution attack.