CVE-2023-23369criticalCWE-77CWE-78

CVE-2023-23369: critical vulnerability in QNAP Systems Inc. QTS

QTS, Multimedia Console, and Media Streaming add-on

Published · Updated

Follow this CVE+ Monitor QTS+ Monitor Media Streaming add-on

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

33Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 9epss 14%
In short

A security flaw in QNAP systems allows attackers to run unauthorized commands over the network by exploiting improper handling of user input. This is a critical vulnerability because it gives attackers full control over the affected device.

Technical detail

OS command injection vulnerability (CWE-77, CWE-78) affecting QNAP QTS, Multimedia Console, and Media Streaming add-on due to insufficient input sanitization. Remote network-based attack vector with no authentication required; successful exploitation enables arbitrary command execution with system privileges.

Summary generated and translated by AI from the official description.
An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow users to execute commands via a network. We have already fixed the vulnerability in the following versions: Multimedia Console 2.1.2 ( 2023/05/04 ) and later Multimedia Console 1.4.8 ( 2023/05/05 ) and later QTS 5.1.0.2399 build 20230515 and later QTS 4.3.6.2441 build 20230621 and later QTS 4.3.4.2451 build 20230621 and later QTS 4.3.3.2420 build 20230621 and later QTS 4.2.6 build 20230621 and later Media Streaming add-on 500.1.1.2 ( 2023/06/12 ) and later Media Streaming add-on 500.0.0.11 ( 2023/06/16 ) and later
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Affected products
QNAP Systems Inc. · Media Streaming add-onQNAP Systems Inc. · Multimedia ConsoleQNAP Systems Inc. · QTS
Related CVEs — QNAP Systems Inc. QTS

In the same product, most dangerous first.

CVE-2020-2509CRITICALCommand Injection Vulnerability in QTS and QuTS heroEPSS 34.0%KEVCVE-2018-19953MEDIUMCVE-2018-19953EPSS 30.5%KEVCVE-2018-19949CRITICALCVE-2018-19949EPSS 30.2%KEVCVE-2018-19943HIGHCVE-2018-19943EPSS 22.7%KEVCVE-2023-47218MEDIUMQTS, QuTS hero, QuTScloudEPSS 89.9%CVE-2023-51364HIGHQTS, QuTS hero, QuTScloudEPSS 39.7%