by Kastro
Paper/Archive/CVE-2023-23364

CVE-2023-23364

QNAP Systems Inc. Multimedia Console — Multimedia Console

EPSS 0.9%CVSS 9.8
critical.is priorityof 100
42
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 60.3.603 × 2012.1No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

A buffer copy without checking size of input vulnerability has been reported to affect QNAP operating systems. If exploited, the vulnerability possibly allows remote users to execute code via unspecified vectors. We have already fixed the vulnerability in the following versions: Multimedia Console 2.1.1 ( 2023/03/29 ) and later Multimedia Console 1.4.7 ( 2023/03/20 ) and later

Affected

ProductAffectedFixed inSource
Multimedia Console2.1.* – < 2.1.1 ( 2023/03/29 )2.1.1 ( 2023/03/29 )CNA
Multimedia Console1.4.* – < 1.4.7 ( 2023/03/20 )1.4.7 ( 2023/03/20 )CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
qnap (CNA)8.1CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

refqnap.com/en/security-advisory/qsa-23-29