by Kastro
Paper/Archive/CVE-2023-23368

CVE-2023-23368

QNAP Systems Inc. QTS — QTS, QuTS hero, QuTScloud

EPSS 19%CVSS 9.8
critical.is priorityof 100
49
CVSS 9.8 (CNA, NVD agree)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 97.3.973 × 2019.5No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow users to execute commands via a network. We have already fixed the vulnerability in the following versions: QTS 5.0.1.2376 build 20230421 and later QTS 4.5.4.2374 build 20230416 and later QuTS hero h5.0.1.2376 build 20230421 and later QuTS hero h4.5.4.2374 build 20230417 and later QuTScloud c5.0.1.2374 and later

Affected

ProductAffectedFixed inSource
QTS5.0.x – < 5.0.1.2376 build 202304215.0.1.2376 build 20230421CNA
QTS4.5.x – < 4.5.4.2374 build 202304164.5.4.2374 build 20230416CNA
QuTS heroh5.0.x – < h5.0.1.2376 build 20230421h5.0.1.2376 build 20230421CNA
QuTS heroh4.5.x – < h4.5.4.2374 build 20230417h4.5.4.2374 build 20230417CNA
QuTScloudc5.x.x – < c5.0.1.2374c5.0.1.2374CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
qnap (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refqnap.com/en/security-advisory/qsa-23-31