by Kastro
Paper/Archive/CVE-2023-23369

CVE-2023-23369

QNAP Systems Inc. Multimedia Console — QTS, Multimedia Console, and Media Streaming add-on

EPSS 14%CVSS 9.8
critical.is priorityof 100
49
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 96.6.966 × 2019.3No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow users to execute commands via a network. We have already fixed the vulnerability in the following versions: Multimedia Console 2.1.2 ( 2023/05/04 ) and later Multimedia Console 1.4.8 ( 2023/05/05 ) and later QTS 5.1.0.2399 build 20230515 and later QTS 4.3.6.2441 build 20230621 and later QTS 4.3.4.2451 build 20230621 and later QTS 4.3.3.2420 build 20230621 and later QTS 4.2.6 build 20230621 and later Media Streaming add-on 500.1.1.2 ( 2023/06/12 ) and later Media Streaming add-on 500.0.0.11 ( 2023/06/16 ) and later

Affected

ProductAffectedFixed inSource
Multimedia Console2.1.x – < 2.1.2 ( 2023/05/04 )2.1.2 ( 2023/05/04 )CNA
Multimedia Console1.4.x – < 1.4.8 ( 2023/05/05 )1.4.8 ( 2023/05/05 )CNA
QTS5.1.x – < 5.1.0.2399 build 202305155.1.0.2399 build 20230515CNA
QTS4.3.6 – < 4.3.6.2441 build 202306214.3.6.2441 build 20230621CNA
QTS4.3.4 – < 4.3.4.2451 build 202306214.3.4.2451 build 20230621CNA
QTS4.3.3 – < 4.3.3.2420 build 202306214.3.3.2420 build 20230621CNA
QTS4.2.x – < 4.2.6 build 202306214.2.6 build 20230621CNA
Media Streaming add-on500.1.x – < 500.1.1.2 ( 2023/06/12 )500.1.1.2 ( 2023/06/12 )CNA
Media Streaming add-on500.0.x – < 500.0.0.11 ( 2023/06/16 )500.0.0.11 ( 2023/06/16 )CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
qnap (CNA)9.0CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

refqnap.com/en/security-advisory/qsa-23-35