CVE-2023-23355

Summary

CVE	CVE-2023-23355
State	PUBLIC
Assigner	[email protected]
Source Priority	CVE Program / NVD first with legacy fallback
Published	2023-03-29 05:15:00 UTC
Updated	2023-09-01 17:10:00 UTC
Description	An OS command injection vulnerability has been reported to affect QNAP operating systems. If exploited, the vulnerability possibly allows remote authenticated administrators to execute commands via unspecified vectors. QES is not affected. We have already fixed the vulnerability in the following versions: QTS 5.0.1.2346 build 20230322 and later QTS 4.5.4.2374 build 20230416 and later QuTS hero h5.0.1.2348 build 20230324 and later QuTS hero h4.5.4.2374 build 20230417 and later QuTScloud c5.0.1.2374 and later

Risk And Classification

Problem Types: CWE-77

NVD Known Affected Configurations (CPE 2.3)

Type	Vendor	Product	Version	Update	Edition	Language
Operating System	Qnap	Qts	All	All	All	All
Operating System	Qnap	Qutscloud	-	All	All	All
Operating System	Qnap	Quts Hero	All	All	All	All
Hardware	Qnap	Qvp-21a	-	All	All	All
Operating System	Qnap	Qvp-21a Firmware	-	All	All	All
Hardware	Qnap	Qvp-41a	-	All	All	All
Operating System	Qnap	Qvp-41a Firmware	-	All	All	All
Hardware	Qnap	Qvp-41b	-	All	All	All
Operating System	Qnap	Qvp-41b Firmware	-	All	All	All
Hardware	Qnap	Qvp-63a	-	All	All	All
Operating System	Qnap	Qvp-63a Firmware	-	All	All	All
Hardware	Qnap	Qvp-63b	-	All	All	All
Operating System	Qnap	Qvp-63b Firmware	-	All	All	All
Hardware	Qnap	Qvp-85a	-	All	All	All
Operating System	Qnap	Qvp-85a Firmware	-	All	All	All
Hardware	Qnap	Qvp-85b	-	All	All	All
Operating System	Qnap	Qvp-85b Firmware	-	All	All	All
Application	Qnap	Qvr	-	All	All	All

References

Reference	Source	Link	Tags
www.qnap.com/en/security-advisory/qsa-23-10	MISC	www.qnap.com
CVE Program record	CVE.ORG	www.cve.org	canonical
NVD vulnerability detail	NVD	nvd.nist.gov	canonical, analysis

No vendor comments have been submitted for this CVE.

Legacy QID Mappings

731061 QNAP QTS OS Command Injection Vulnerability (QSA-23-10)