CVE-2023-23355

Published: Mar 29, 2023Modified: Jun 17, 2026

7.2

Vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Exploitability: 1.2 / Impact: 5.9

Source: NVD

Description

An OS command injection vulnerability has been reported to affect QNAP operating systems. If exploited, the vulnerability possibly allows remote authenticated administrators to execute commands via unspecified vectors. QES is not affected. We have already fixed the vulnerability in the following versions: QTS 5.0.1.2346 build 20230322 and later QTS 4.5.4.2374 build 20230416 and later QuTS hero h5.0.1.2348 build 20230324 and later QuTS hero h4.5.4.2374 build 20230417 and later QuTScloud c5.0.1.2374 and later

Affected (11)

Products: Qnap: Qts, Quts Hero, Qutscloud, Qvr, Qvp 41b Firmware, Qvp 63b Firmware, Qvp 85b Firmware, Qvp 21a Firmware, Qvp 41a Firmware, Qvp 63a Firmware, Qvp 85a Firmware

11 products

Configuration A

4 vulnerable

Vulnerable Software	Affected Versions
Qnap Qts	Before 5.0.1.2346
Qnap Quts Hero	Before h5.0.1.2348
Qnap Qutscloud	All versions
Qnap Qvr	All versions

Configuration B

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Qnap Qvp 41b Firmware	All versions

Running on/with	Platform Versions
Qnap Qvp 41b	All versions

Configuration C

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Qnap Qvp 63b Firmware	All versions

Running on/with	Platform Versions
Qnap Qvp 63b	All versions

Configuration D

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Qnap Qvp 85b Firmware	All versions

Running on/with	Platform Versions
Qnap Qvp 85b	All versions

Configuration E

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Qnap Qvp 21a Firmware	All versions

Running on/with	Platform Versions
Qnap Qvp 21a	All versions

Configuration F

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Qnap Qvp 41a Firmware	All versions

Running on/with	Platform Versions
Qnap Qvp 41a	All versions

Configuration G

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Qnap Qvp 63a Firmware	All versions

Running on/with	Platform Versions
Qnap Qvp 63a	All versions

Configuration H

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Qnap Qvp 85a Firmware	All versions

Running on/with	Platform Versions
Qnap Qvp 85a	All versions

Related CWEs

CWE-77

Improper Neutralization of Special Elements used in a Command ('Command Injection')

The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.

CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

References (2)

https://www.qnap.com/en/security-advisory/qsa-23-10

Source: security@qnapsecurity.com.tw

Vendor Advisory

https://www.qnap.com/en/security-advisory/qsa-23-10

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.