An OS command injection vulnerability has been reported to affect QNAP operating systems. If exploited, the vulnerability allows remote authenticated users to execute commands via susceptible QNAP devices.
We have already fixed the vulnerability in the following versions:
QTS 5.0.1.2376 build 20230421 and later
QTS 4.5.4.2374 build 20230416 and later
QuTS hero h5.0.1.2376 build 20230421 and later
QuTS hero h4.5.4.2374 build 20230417 and later
QuTScloud c5.0.1.2374 and later
References
Link | Resource |
---|---|
https://www.qnap.com/en/security-advisory/qsa-23-18 | Vendor Advisory |
Configurations
Configuration 1 (hide)
|
History
26 Sep 2023, 14:03
Type | Values Removed | Values Added |
---|---|---|
CVSS |
v2 : v3 : |
v2 : unknown
v3 : 8.8 |
CPE | cpe:2.3:o:qnap:qutscloud:*:*:*:*:*:*:*:* cpe:2.3:o:qnap:quts_hero:*:*:*:*:*:*:*:* cpe:2.3:o:qnap:qts:*:*:*:*:*:*:*:* |
|
CWE | CWE-78 | |
First Time |
Qnap qutscloud
Qnap Qnap qts Qnap quts Hero |
|
References | (MISC) https://www.qnap.com/en/security-advisory/qsa-23-18 - Vendor Advisory |
22 Sep 2023, 04:15
Type | Values Removed | Values Added |
---|---|---|
New CVE |
Information
Published : 2023-09-22 04:15
Updated : 2024-02-28 20:33
NVD link : CVE-2023-23362
Mitre link : CVE-2023-23362
CVE.ORG link : CVE-2023-23362
JSON object : View
Products Affected
qnap
- qts
- qutscloud
- quts_hero
CWE
CWE-78
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')