← All CVEs

CVE-2023-23369

critical · 9

An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow users to execute commands via a network. We have already fixed the vulnerability in the following versions: Multimedia Console 2.1.2 ( 2023/05/04 ) and later Multimedia Console 1.4.8 ( 2023/05/05 ) and later QTS 5.1.0.2399 build 20230515 and later QTS 4.3.6.2441 build 20230621 and later QTS 4.3.4.2451 build 20230621 and later QTS 4.3.3.2420 build 20230621 and later QTS 4.2.6 build 20230621 and later Media Streaming add-on 500.1.1.2 ( 2023/06/12 ) and later Media Streaming add-on 500.0.0.11 ( 2023/06/16 ) and later

9
CVSS
14.5%
EPSS (exploit prob.)
96th
EPSS percentile
2023-11-03
Published

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

Weaknesses

CWE-77CWE-78

Affected products

VendorProductAffected versions
qnapqts5.1.0.2348
qnapqts4.3.6.0895
qnapqts4.3.6.0907
qnapqts4.3.6.0923
qnapqts4.3.6.0944
qnapqts4.3.6.0959
qnapqts4.3.6.0979
qnapqts4.3.6.0993
qnapqts4.3.6.1013
qnapqts4.3.6.1033
qnapqts4.3.6.1070
qnapqts4.3.6.1154
qnapqts4.3.6.1218
qnapqts4.3.6.1263
qnapqts4.3.6.1286
qnapqts4.3.6.1333
qnapqts4.3.6.1411
qnapqts4.3.6.1446
qnapqts4.3.6.1620
qnapqts4.3.6.1663
qnapqts4.3.6.1711
qnapqts4.3.6.1750
qnapqts4.3.6.1831
qnapqts4.3.6.1907
qnapqts4.3.6.1965
qnapqts4.3.6.2050
qnapqts4.3.6.2232
qnapqts4.3.4.0899
qnapqts4.3.4.1029
qnapqts4.3.4.1082
qnapqts4.3.4.1190
qnapqts4.3.4.1282
qnapqts4.3.4.1368
qnapqts4.3.4.1417
qnapqts4.3.4.1463
qnapqts4.3.4.1632
qnapqts4.3.4.1652
qnapqts4.3.4.1976
qnapqts4.3.4.2107
qnapqts4.3.4.2242

Check a specific version with /api/v1/cve/match.

References

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2023-23369