CVE-2023-30801criticalobserved exploitationCWE-1392

CVE-2023-30801: critical vulnerability in qBittorrent client

qBittorrent Web UI Default Credentials Lead to RCE

Published · Updated

Follow this CVE+ Monitor qBittorrent client+ Monitor qbittorrent

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

50Vexday Risk Score

Prioritize patching. It exploitation observed by VulnCheck.

ssvc Actcvss 9.8epss 1.2%
from disclosure to weapon
Published on NVDOct 10
VulnCheckMar 19
In short

qBittorrent's web interface uses default credentials that don't have to be changed, allowing anyone to log in and run commands on the computer. This is a critical flaw because attackers can take full control of the system.

Technical detail

CWE-1392 involves use of default credentials in the web UI of qBittorrent versions ≤4.5.5; no mandatory credential change exists. Remote attackers can authenticate with known defaults and leverage the "external program" feature to achieve arbitrary code execution on the host system. Exploitation was observed in the wild as of March 2023.

Summary generated and translated by AI from the official description.
All versions of the qBittorrent client through 4.5.5 use default credentials when the web user interface is enabled. The administrator is not forced to change the default credentials. As of 4.5.5, this issue has not been fixed. A remote attacker can use the default credentials to authenticate and execute arbitrary operating system commands using the "external program" feature in the web user interface. This was reportedly exploited in the wild in March 2023.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
qBittorrent · qBittorrent client