by Kastro
Paper/Archive/CVE-2023-30801

CVE-2023-30801

qBittorrent qBittorrent client — qBittorrent Web UI Default Credentials Lead to RCE

EPSS 1%CVSS 9.8
critical.is priorityof 100
43
CVSS 9.8 (CNA, NVD agree)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 69.2.692 × 2013.8No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

All versions of the qBittorrent client through 4.5.5 use default credentials when the web user interface is enabled. The administrator is not forced to change the default credentials. As of 4.5.5, this issue has not been fixed. A remote attacker can use the default credentials to authenticate and execute arbitrary operating system commands using the "external program" feature in the web user interface. This was reportedly exploited in the wild in March 2023.

Affected

ProductAffectedFixed inSource
qBittorrent client≤ 4.5.5–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
VulnCheck (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

refgithub.com/qbittorrent/qBittorrent/issues/18731writeupvulncheck.com/advisories/qbittorrent-default-credsreflists.fedoraproject.org/archives/list/[email protected]/message/T5WXBKELVZFZNIDONIJESOCSRPIQNCGIreflists.fedoraproject.org/archives/list/[email protected]/message/U4BNFJR3ZWVLE2YSYIQYBWVDQBBZOLEL