Strix
26.1K

CVE-2023-23367

HIGHCVSS 7.2/10EPSS 1.50%

Last modified

CVE-2023-23367 is a high-severity vulnerability rated 7.2/10 on the CVSS scale. An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated administrators to execute commands via a network. We have already fixed the vulnerability in the following versions: QTS 5.0.1.2376 build 20230421 and later QuTS hero h5.0.1.2376 build 20230421 and later QuTScloud c5.1.0.2498 and later . EPSS estimates a 1.50% chance of exploitation in the next 30 days.

Description

An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated administrators to execute commands via a network. We have already fixed the vulnerability in the following versions: QTS 5.0.1.2376 build 20230421 and later QuTS hero h5.0.1.2376 build 20230421 and later QuTScloud c5.1.0.2498 and later

Metrics

CVSS 3.1
7.2/10

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

EPSS Probability
1.50%

70.9th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

Affected Software

VendorProductVersionsUpdate
QnapQts5.0.0.1716Build 20210701
QnapQts5.0.0.1785Build 20210908
QnapQts5.0.0.1808Build 20211001
QnapQts5.0.0.1828Build 20211020
QnapQts5.0.0.1837Build 20211029
QnapQts5.0.0.1850Build 20211111
QnapQts5.0.0.1853Build 20211114
QnapQts5.0.0.1858Build 20211119
QnapQts5.0.0.1870Build 20211201
QnapQts5.0.1.2034Build 20220515
QnapQts5.0.1.2079Build 20220629
QnapQts5.0.1.2131Build 20220820
QnapQts5.0.1.2137Build 20220826
QnapQts5.0.1.2145Build 20220903
QnapQts5.0.1.2173Build 20221001
QnapQts5.0.1.2194Build 20221022
QnapQts5.0.1.2234Build 20221201
QnapQts5.0.1.2248Build 20221215
QnapQts5.0.1.2277Build 20230112
QnapQts5.0.1.2346Build 20230322
QnapQuts Heroh5.0.0.1772Build 20210826
QnapQuts Heroh5.0.0.1844Build 20211105
QnapQuts Heroh5.0.0.1856Build 20211117
QnapQuts Heroh5.0.0.1892Build 20211222
QnapQuts Heroh5.0.0.1900Build 20211228
QnapQuts Heroh5.0.0.1949Build 20220215
QnapQuts Heroh5.0.0.1986Build 20220324
QnapQuts Heroh5.0.0.2022Build 20220428
QnapQuts Heroh5.0.0.2069Build 20220614
QnapQuts Heroh5.0.0.2120Build 20220804
QnapQuts Heroh5.0.1.2045Build 20220526
QnapQuts Heroh5.0.1.2192Build 20221020
QnapQuts Heroh5.0.1.2248Build 20221215
QnapQuts Heroh5.0.1.2269Build 20230104
QnapQuts Heroh5.0.1.2277Build 20230112
QnapQuts Heroh5.0.1.2348Build 20230324
QnapQutscloudc5.0.0.1919Build 20220119
QnapQutscloudc5.0.1.1949Build 20220218
QnapQutscloudc5.0.1.1998Build 20220408
QnapQutscloudc5.0.1.2044Build 20220524
QnapQutscloudc5.0.1.2148Build 20220905
QnapQutscloudc5.0.1.2374Build 20230419

References

Timeline

Published
Last Modified
Status
Modified

Frequently Asked Questions

What is CVE-2023-23367?
An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated administrators to execute commands via a network. We have already fixed the vulnerability in the following versions: QTS 5.0.1.2376 build 20230421 and later QuTS hero h5.0.1.2376 build 20230421 and later QuTScloud c5.1.0.2498 and later
How severe is CVE-2023-23367?
CVE-2023-23367 has a CVSS score of 7.2/10 (HIGH severity). The EPSS model estimates a 1.50% probability of exploitation in the next 30 days.
How do I fix CVE-2023-23367?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2023-23367?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST