CVE-2023-23362

An OS command injection vulnerability has been reported to affect QNAP operating systems. If exploited, the vulnerability allows remote authenticated users to execute commands via susceptible QNAP devices. We have already fixed the vulnerability in the following versions: QTS 5.0.1.2376 build 20230421 and later QTS 4.5.4.2374 build 20230416 and later QuTS hero h5.0.1.2376 build 20230421 and later QuTS hero h4.5.4.2374 build 20230417 and later QuTScloud c5.0.1.2374 and later
References
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:qnap:qts:*:*:*:*:*:*:*:*
cpe:2.3:o:qnap:qts:*:*:*:*:*:*:*:*
cpe:2.3:o:qnap:quts_hero:*:*:*:*:*:*:*:*
cpe:2.3:o:qnap:quts_hero:*:*:*:*:*:*:*:*
cpe:2.3:o:qnap:qutscloud:*:*:*:*:*:*:*:*

History

26 Sep 2023, 14:03

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown
v2 : unknown
v3 : 8.8
CPE cpe:2.3:o:qnap:qutscloud:*:*:*:*:*:*:*:*
cpe:2.3:o:qnap:quts_hero:*:*:*:*:*:*:*:*
cpe:2.3:o:qnap:qts:*:*:*:*:*:*:*:*
CWE CWE-78
First Time Qnap qutscloud
Qnap
Qnap qts
Qnap quts Hero
References (MISC) https://www.qnap.com/en/security-advisory/qsa-23-18 - (MISC) https://www.qnap.com/en/security-advisory/qsa-23-18 - Vendor Advisory

22 Sep 2023, 04:15

Type Values Removed Values Added
New CVE

Information

Published : 2023-09-22 04:15

Updated : 2024-02-28 20:33


NVD link : CVE-2023-23362

Mitre link : CVE-2023-23362

CVE.ORG link : CVE-2023-23362


JSON object : View

Products Affected

qnap

  • qts
  • qutscloud
  • quts_hero
CWE
CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')