CVE-2023-23369 is a critical OS command injection vulnerability impacting several QNAP operating system versions, including QTS, Multimedia Console, and Media Streaming add-on. With a CVSS score of 9.8 (CRITICAL), it allows unauthenticated attackers to execute arbitrary commands remotely with low attack complexity, leading to full compromise of confidentiality, integrity, and availability. While there is no confirmed active exploitation or public exploit code, the vulnerability has garnered significant community attention, with mentions on Mastodon and coverage by BleepingComputer, indicating a high potential for future exploitation. QNAP has released patches for affected versions.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
5.1.0.2348CPE matchmatch criteria | cpe:2.3:o:qnap:qts:5.1.0.2348:build_20230325:*:*:*:*:*:* | ||
4.3.6.0895CPE matchmatch criteria | cpe:2.3:o:qnap:qts:4.3.6.0895:build_20190328:*:*:*:*:*:* | ||
4.3.6.0907CPE matchmatch criteria | cpe:2.3:o:qnap:qts:4.3.6.0907:build_20190409:*:*:*:*:*:* | ||
4.3.6.0923CPE matchmatch criteria | cpe:2.3:o:qnap:qts:4.3.6.0923:build_20190425:*:*:*:*:*:* | ||
4.3.6.0944CPE matchmatch criteria | cpe:2.3:o:qnap:qts:4.3.6.0944:build_20190516:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.