CVE-2023-23368
Last modified
CVE-2023-23368 is a critical-severity vulnerability rated 9.8/10 on the CVSS scale. An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow users to execute commands via a network. We have already fixed the vulnerability in the following versions: QTS 5.0.1.2376 build 20230421 and later QTS 4.5.4.2374 build 20230416 and later QuTS hero h5.0.1.2376 build 20230421 and later QuTS hero h4.5.4.2374 build 20230417 and later QuTScloud c5.0.1.2374 and later . EPSS estimates a 18.69% chance of exploitation in the next 30 days.
Description
An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow users to execute commands via a network. We have already fixed the vulnerability in the following versions: QTS 5.0.1.2376 build 20230421 and later QTS 4.5.4.2374 build 20230416 and later QuTS hero h5.0.1.2376 build 20230421 and later QuTS hero h4.5.4.2374 build 20230417 and later QuTScloud c5.0.1.2374 and later
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness Enumeration
Affected Software
| Vendor | Product | Versions | Update |
|---|---|---|---|
| Qnap | Qts | 5.0.1 | — |
| Qnap | Qts | 5.0.1.2034 | Build 20220515 |
| Qnap | Qts | 5.0.1.2079 | Build 20220629 |
| Qnap | Qts | 5.0.1.2131 | Build 20220820 |
| Qnap | Qts | 5.0.1.2137 | Build 20220826 |
| Qnap | Qts | 5.0.1.2145 | Build 20220903 |
| Qnap | Qts | 5.0.1.2173 | Build 20221001 |
| Qnap | Qts | 5.0.1.2194 | Build 20221022 |
| Qnap | Qts | 5.0.1.2234 | Build 20221201 |
| Qnap | Qts | 5.0.1.2248 | Build 20221215 |
| Qnap | Qts | 5.0.1.2277 | Build 20230112 |
| Qnap | Qts | 5.0.1.2346 | Build 20230322 |
| Qnap | Qts | 4.5.4 | — |
| Qnap | Qts | 4.5.4.1715 | Build 20210630 |
| Qnap | Qts | 4.5.4.1723 | Build 20210708 |
| Qnap | Qts | 4.5.4.1741 | Build 20210726 |
| Qnap | Qts | 4.5.4.1787 | Build 20210910 |
| Qnap | Qts | 4.5.4.1800 | Build 20210923 |
| Qnap | Qts | 4.5.4.1892 | Build 20211223 |
| Qnap | Qts | 4.5.4.1931 | Build 20220128 |
| Qnap | Qts | 4.5.4.2012 | Build 20220419 |
| Qnap | Qts | 4.5.4.2117 | Build 20220802 |
| Qnap | Qts | 4.5.4.2280 | Build 20230112 |
| Qnap | Quts Hero | h5.0.1.2045 | Build 20220526 |
| Qnap | Quts Hero | h5.0.1.2192 | Build 20221020 |
| Qnap | Quts Hero | h5.0.1.2248 | Build 20221215 |
| Qnap | Quts Hero | h5.0.1.2269 | Build 20230104 |
| Qnap | Quts Hero | h5.0.1.2277 | Build 20230112 |
| Qnap | Quts Hero | h5.0.1.2348 | Build 20230324 |
| Qnap | Quts Hero | h4.5.4.1771 | Build 20210825 |
| Qnap | Quts Hero | h4.5.4.1800 | Build 20210923 |
| Qnap | Quts Hero | h4.5.4.1813 | Build 20211006 |
| Qnap | Quts Hero | h4.5.4.1848 | Build 20211109 |
| Qnap | Quts Hero | h4.5.4.1892 | Build 20211223 |
| Qnap | Quts Hero | h4.5.4.1951 | Build 20220218 |
| Qnap | Quts Hero | h4.5.4.1971 | Build 20220310 |
| Qnap | Quts Hero | h4.5.4.1991 | Build 20220330 |
| Qnap | Quts Hero | h4.5.4.2052 | Build 20220530 |
| Qnap | Quts Hero | h4.5.4.2138 | Build 20220824 |
| Qnap | Quts Hero | h4.5.4.2217 | Build 20221111 |
| Qnap | Quts Hero | h4.5.4.2272 | Build 20230105 |
| Qnap | Qutscloud | c5.0.1.1949 | Build 20220218 |
| Qnap | Qutscloud | c5.0.1.1998 | Build 20220408 |
| Qnap | Qutscloud | c5.0.1.2044 | Build 20220524 |
| Qnap | Qutscloud | c5.0.1.2148 | Build 20220905 |
References
- https://www.qnap.com/en/security-advisory/qsa-23-31Vendor Advisory
- https://www.qnap.com/en/security-advisory/qsa-23-31Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2023-23368?
How severe is CVE-2023-23368?
How do I fix CVE-2023-23368?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2023
- CVE-2023-23362An OS command injection vulnerability has been reported to a…8.8
- CVE-2023-23363A buffer copy without checking size of input vulnerability h…9.8
- CVE-2023-23364A buffer copy without checking size of input vulnerability h…9.8
- CVE-2023-23365A path traversal vulnerability has been reported to affect M…6.5
- CVE-2023-23366A path traversal vulnerability has been reported to affect M…6.5
- CVE-2023-23367An OS command injection vulnerability has been reported to a…7.2
- CVE-2023-23369An OS command injection vulnerability has been reported to a…9.8
- CVE-2023-2337The ConvertKit WordPress plugin before 2.2.1 does not escape…6.1
- CVE-2023-23370An insufficiently protected credentials vulnerability has be…4.4
- CVE-2023-23371A cleartext transmission of sensitive information vulnerabil…4.4
- CVE-2023-23372A cross-site scripting (XSS) vulnerability has been reported…6.1
- CVE-2023-23373An OS command injection vulnerability has been reported to a…8.8
Are you affected by CVE-2023-23368?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST