QTS, Multimedia Console, and Media Streaming add-on
CVE-2023-23369

9.8CRITICAL

Key Information:

Vendor
QNAP
Status
Multimedia Console
QTS
Media Streaming add-on
Vendor
CVE Published:
3 November 2023

Summary

An OS command injection vulnerability exists in multiple QNAP operating system versions, potentially allowing attackers to execute arbitrary commands over the network. This vulnerability impacts various products and has been addressed in specific updates. Users are encouraged to update their systems to the latest versions to mitigate potential risks.

Affected Version(s)

Media Streaming add-on 500.1.x < 500.1.1.2 ( 2023/06/12 )

Media Streaming add-on 500.0.x < 500.0.0.11 ( 2023/06/16 )

Multimedia Console 2.1.x < 2.1.2 ( 2023/05/04 )

References

https://www.qnap.com/en/security-advisory/qsa-23-35

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Eqqie
.