CVE-2023-23362

HIGH

QNAP QTS 4.5.4-4.5.4.2374 and QTS 5.0.1-5.0.1.2376 - Authenticated OS Command Injection

Title source: llm
STIX 2.1

Description

An OS command injection vulnerability has been reported to affect QNAP operating systems. If exploited, the vulnerability allows remote authenticated users to execute commands via susceptible QNAP devices. We have already fixed the vulnerability in the following versions: QTS 5.0.1.2376 build 20230421 and later QTS 4.5.4.2374 build 20230416 and later QuTS hero h5.0.1.2376 build 20230421 and later QuTS hero h4.5.4.2374 build 20230417 and later QuTScloud c5.0.1.2374 and later

References (1)

Core 1
Core References

Scores

CVSS v3 8.8
EPSS 0.0043
EPSS Percentile 62.9%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact total

Details

CWE
CWE-78
Status published
Products (3)
qnap/qts 4.5.4 - 4.5.4.2374
qnap/quts_hero h4.5.4 - h4.5.4.2374
qnap/qutscloud c5.0.1 - c5.0.1.2374
Published Sep 22, 2023
Tracked Since Feb 18, 2026