CVE-2023-23355
An OS command injection vulnerability has been reported to affect QNAP operating systems.
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (1.23%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
An OS command injection vulnerability has been reported to affect QNAP operating systems. If exploited, the vulnerability possibly allows remote authenticated administrators to execute commands via unspecified vectors. QES is not affected. We have already fixed the vulnerability in the following versions: QTS 5.0.1.2346 build 20230322 and later QTS 4.5.4.2374 build 20230416 and later QuTS hero h5.0.1.2348 build 20230324 and later QuTS hero h4.5.4.2374 build 20230417 and later QuTScloud c5.0.1.2374 and later
- CVSS 3.1
- 7.2 HIGHCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 1.23% probability · 67th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-77, CWE-78
- Affected
- qnap/qvr · qnap/qts · qnap/quts hero · qnap/qutscloud · qnap/qvp-41b firmware · qnap/qvp-63b firmware · qnap/qvp-85b firmware · qnap/qvp-21a firmware · qnap/qvp-41a firmware · qnap/qvp-63a firmware · qnap/qvp-85a firmware
- Source
- security@qnapsecurity.com.tw
References
- https://www.qnap.com/en/security-advisory/qsa-23-10Vendor Advisory
- https://www.qnap.com/en/security-advisory/qsa-23-10Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.