CVE-2023-23368

Опубликовано: 03 нояб. 2023

Источник: nvd

CVSS3: 9.8

EPSS Низкий

Описание

An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow users to execute commands via a network.

We have already fixed the vulnerability in the following versions: QTS 5.0.1.2376 build 20230421 and later QTS 4.5.4.2374 build 20230416 and later QuTS hero h5.0.1.2376 build 20230421 and later QuTS hero h4.5.4.2374 build 20230417 and later QuTScloud c5.0.1.2374 and later

Ссылки

https://www.qnap.com/en/security-advisory/qsa-23-31
Vendor Advisory
https://www.qnap.com/en/security-advisory/qsa-23-31
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:o:qnap:qts:5.0.1:-:*:*:*:*:*:*

cpe:2.3:o:qnap:qts:5.0.1.2034:build_20220515:*:*:*:*:*:*

cpe:2.3:o:qnap:qts:5.0.1.2079:build_20220629:*:*:*:*:*:*

cpe:2.3:o:qnap:qts:5.0.1.2131:build_20220820:*:*:*:*:*:*

cpe:2.3:o:qnap:qts:5.0.1.2137:build_20220826:*:*:*:*:*:*

cpe:2.3:o:qnap:qts:5.0.1.2145:build_20220903:*:*:*:*:*:*

cpe:2.3:o:qnap:qts:5.0.1.2173:build_20221001:*:*:*:*:*:*

cpe:2.3:o:qnap:qts:5.0.1.2194:build_20221022:*:*:*:*:*:*

cpe:2.3:o:qnap:qts:5.0.1.2234:build_20221201:*:*:*:*:*:*

cpe:2.3:o:qnap:qts:5.0.1.2248:build_20221215:*:*:*:*:*:*

cpe:2.3:o:qnap:qts:5.0.1.2277:build_20230112:*:*:*:*:*:*

cpe:2.3:o:qnap:qts:5.0.1.2346:build_20230322:*:*:*:*:*:*

Конфигурация 2

Одно из

cpe:2.3:o:qnap:qts:4.5.4:-:*:*:*:*:*:*

cpe:2.3:o:qnap:qts:4.5.4.1715:build_20210630:*:*:*:*:*:*

cpe:2.3:o:qnap:qts:4.5.4.1723:build_20210708:*:*:*:*:*:*

cpe:2.3:o:qnap:qts:4.5.4.1741:build_20210726:*:*:*:*:*:*

cpe:2.3:o:qnap:qts:4.5.4.1787:build_20210910:*:*:*:*:*:*

cpe:2.3:o:qnap:qts:4.5.4.1800:build_20210923:*:*:*:*:*:*

cpe:2.3:o:qnap:qts:4.5.4.1892:build_20211223:*:*:*:*:*:*

cpe:2.3:o:qnap:qts:4.5.4.1931:build_20220128:*:*:*:*:*:*

cpe:2.3:o:qnap:qts:4.5.4.2012:build_20220419:*:*:*:*:*:*

cpe:2.3:o:qnap:qts:4.5.4.2117:build_20220802:*:*:*:*:*:*

cpe:2.3:o:qnap:qts:4.5.4.2280:build_20230112:*:*:*:*:*:*

Конфигурация 3

Одно из

cpe:2.3:o:qnap:quts_hero:h5.0.1.2045:build_20220526:*:*:*:*:*:*

cpe:2.3:o:qnap:quts_hero:h5.0.1.2192:build_20221020:*:*:*:*:*:*

cpe:2.3:o:qnap:quts_hero:h5.0.1.2248:build_20221215:*:*:*:*:*:*

cpe:2.3:o:qnap:quts_hero:h5.0.1.2269:build_20230104:*:*:*:*:*:*

cpe:2.3:o:qnap:quts_hero:h5.0.1.2277:build_20230112:*:*:*:*:*:*

cpe:2.3:o:qnap:quts_hero:h5.0.1.2348:build_20230324:*:*:*:*:*:*

Конфигурация 4

Одно из

cpe:2.3:o:qnap:quts_hero:h4.5.4.1771:build_20210825:*:*:*:*:*:*

cpe:2.3:o:qnap:quts_hero:h4.5.4.1800:build_20210923:*:*:*:*:*:*

cpe:2.3:o:qnap:quts_hero:h4.5.4.1813:build_20211006:*:*:*:*:*:*

cpe:2.3:o:qnap:quts_hero:h4.5.4.1848:build_20211109:*:*:*:*:*:*

cpe:2.3:o:qnap:quts_hero:h4.5.4.1892:build_20211223:*:*:*:*:*:*

cpe:2.3:o:qnap:quts_hero:h4.5.4.1951:build_20220218:*:*:*:*:*:*

cpe:2.3:o:qnap:quts_hero:h4.5.4.1971:build_20220310:*:*:*:*:*:*

cpe:2.3:o:qnap:quts_hero:h4.5.4.1991:build_20220330:*:*:*:*:*:*

cpe:2.3:o:qnap:quts_hero:h4.5.4.2052:build_20220530:*:*:*:*:*:*

cpe:2.3:o:qnap:quts_hero:h4.5.4.2138:build_20220824:*:*:*:*:*:*

cpe:2.3:o:qnap:quts_hero:h4.5.4.2217:build_20221111:*:*:*:*:*:*

cpe:2.3:o:qnap:quts_hero:h4.5.4.2272:build_20230105:*:*:*:*:*:*

Конфигурация 5

Одно из

cpe:2.3:o:qnap:qutscloud:c5.0.1.1949:build_20220218:*:*:*:*:*:*

cpe:2.3:o:qnap:qutscloud:c5.0.1.1998:build_20220408:*:*:*:*:*:*

cpe:2.3:o:qnap:qutscloud:c5.0.1.2044:build_20220524:*:*:*:*:*:*

cpe:2.3:o:qnap:qutscloud:c5.0.1.2148:build_20220905:*:*:*:*:*:*

EPSS

Процентиль: 87%

0.03562

Низкий

9.8 Critical

CVSS3

Дефекты

CWE-78

Связанные уязвимости

GHSA-vccx-mhx2-8xvf

CVSS3: 9.8

github

больше 2 лет назад

An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow users to execute commands via a network. We have already fixed the vulnerability in the following versions: QTS 5.0.1.2376 build 20230421 and later QTS 4.5.4.2374 build 20230416 and later QuTS hero h5.0.1.2376 build 20230421 and later QuTS hero h4.5.4.2374 build 20230417 and later QuTScloud c5.0.1.2374 and later

BDU:2023-07514

CVSS3: 9.8

fstec

больше 2 лет назад

Уязвимость операционных систем QuTS hero, QTS, QuTScloud сетевых устройств Qnap, связанная с возможностью внедрения команд, позволяющая нарушителю выполнять произвольные команды

EPSS

Процентиль: 87%

0.03562

Низкий

9.8 Critical

CVSS3

Дефекты

CWE-78