Vigie VulnDBEuropean-hosted Vulnerability DB
FR
Menu

QTS, QuTS hero, QuTScloud (QNAP Systems Inc. QuTS hero)

CVE-2023-34975
MEDIUM 6.6

At a glance

Source
NVD
EPSS
EPSS 1.22 % · percentile 69 ()
State
PUBLISHED
Published
Updated
Assigner
qnap
NVD status
Modified

Search on…

Description

An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated administrators to execute commands via a network. QuTScloud is not affected. We have already fixed the vulnerability in the following versions: QuTS hero h4.5.4.2626 build 20231225 and later QTS 4.5.4.2627 build 20231225 and later

Weaknesses (CWE)

  • CWE-78 — Improper Neutralization of Special Elements used in an OS Command
  • CWE-89 — Improper Neutralization of Special Elements used in an SQL Command

References

Scores

VersionScoreVectorScored by
CVSS 3.1MEDIUM 6.6CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:Lqnap
CVSS 3.1MEDIUM 6.6CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:LNVD · security@qnapsecurity.com.tw (Secondary)
CVSS 3.1HIGH 8.8CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HNVD · nvd@nist.gov (Primary)

European references

CERT-FR advisories

Affected configurations (NVD CPE)

Affected products

ProductVersions
QNAP Systems Inc. · QuTS heroaffected h4.5.x < h4.5.4.2626 build 20231225
QNAP Systems Inc. · QTSaffected 4.5.x < 4.5.4.2627 build 20231225
QNAP Systems Inc. · QuTScloudunaffected c5.x.x < 4.5.4.2627 build 20231225

Sources

SourceLicence
CVE List (CVEProject cvelistV5)CVE Program Terms of Use
EPSS (FIRST.org)FIRST — attribution requested
ENISA EUVDENISA — reproduction authorised, source acknowledged
CERT-FR (ANSSI)Licence Ouverte / Etalab 2.0
NVD (NIST) via fkie-cad/nvd-json-data-feedsPublic domain — this product uses data from the NVD API but is not endorsed or certified by the NVD