SOC status:Duty analyst on shift

UK Cyber Defence
VulnerabilityModified

CVE-2023-23355

An OS command injection vulnerability has been reported to affect QNAP operating systems.

HIGH 7.2EPSS 1.23%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (1.23%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

An OS command injection vulnerability has been reported to affect QNAP operating systems. If exploited, the vulnerability possibly allows remote authenticated administrators to execute commands via unspecified vectors. QES is not affected. We have already fixed the vulnerability in the following versions: QTS 5.0.1.2346 build 20230322 and later QTS 4.5.4.2374 build 20230416 and later QuTS hero h5.0.1.2348 build 20230324 and later QuTS hero h4.5.4.2374 build 20230417 and later QuTScloud c5.0.1.2374 and later

CVSS 3.1
7.2 HIGHCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
EPSS
1.23% probability · 67th percentile
CISA KEV
Not listed
Weakness
CWE-77, CWE-78
Affected
qnap/qvr · qnap/qts · qnap/quts hero · qnap/qutscloud · qnap/qvp-41b firmware · qnap/qvp-63b firmware · qnap/qvp-85b firmware · qnap/qvp-21a firmware · qnap/qvp-41a firmware · qnap/qvp-63a firmware · qnap/qvp-85a firmware
Source
security@qnapsecurity.com.tw

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.