by Kastro
Paper/Archive/CVE-2023-45025

CVE-2023-45025

QNAP Systems Inc. QTS — QTS, QuTS hero, QuTScloud

EPSS 1%CVSS 9.8
critical.is priorityof 100
43
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 66.4.664 × 2013.3No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow users to execute commands via a network. We have already fixed the vulnerability in the following versions: QTS 5.1.4.2596 build 20231128 and later QTS 4.5.4.2627 build 20231225 and later QuTS hero h5.1.4.2596 build 20231128 and later QuTS hero h4.5.4.2626 build 20231225 and later QuTScloud c5.1.5.2651 and later

Affected

ProductAffectedFixed inSource
QTS5.1.x – < 5.1.4.2596 build 202311285.1.4.2596 build 20231128CNA
QTS4.5.x – < 4.5.4.2627 build 202312254.5.4.2627 build 20231225CNA
QuTS heroh5.1.x – < h5.1.4.2596 build 20231128h5.1.4.2596 build 20231128CNA
QuTS heroh4.5.x – < h4.5.4.2626 build 20231225h4.5.4.2626 build 20231225CNA
QuTScloudc5.x.x – < c5.1.5.2651c5.1.5.2651CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
qnap (CNA)9.0CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

refqnap.com/en/security-advisory/qsa-23-47