CVE-2023-45025 is a critical OS command injection vulnerability affecting QNAP QTS, QuTS hero, and QuTScloud operating systems. It allows unauthenticated attackers to execute arbitrary commands remotely over the network with low attack complexity, leading to complete compromise of confidentiality, integrity, and availability. While there is no public exploit code or active exploitation confirmed, the vulnerability has garnered significant community attention and media coverage, indicating a high potential for future exploitation. QNAP has released patches for affected versions.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
4.5.4.1715CPE matchmatch criteria | cpe:2.3:o:qnap:qts:4.5.4.1715:build_20210630:*:*:*:*:*:* | ||
4.5.4.1723CPE matchmatch criteria | cpe:2.3:o:qnap:qts:4.5.4.1723:build_20210708:*:*:*:*:*:* | ||
4.5.4.1741CPE matchmatch criteria | cpe:2.3:o:qnap:qts:4.5.4.1741:build_20210726:*:*:*:*:*:* | ||
4.5.4.1787CPE matchmatch criteria | cpe:2.3:o:qnap:qts:4.5.4.1787:build_20210910:*:*:*:*:*:* | ||
4.5.4.1800CPE matchmatch criteria | cpe:2.3:o:qnap:qts:4.5.4.1800:build_20210923:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.