QTS, QuTS hero, QuTScloud
CVE-2023-45025
9.8CRITICAL
Summary
An OS command injection vulnerability has been identified in multiple QNAP operating system versions. This flaw allows attackers to execute arbitrary commands through network access, potentially compromising the integrity and security of affected systems. Preventive measures and patch updates have been released to mitigate the risk associated with this vulnerability. Users are advised to update to the latest versions to ensure protection against unauthorized access and command execution.
Affected Version(s)
QTS 5.1.x < 5.1.4.2596 build 20231128
QTS 4.5.x < 4.5.4.2627 build 20231225
QuTS hero h5.1.x
References
CVSS V3.1
Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged
Timeline
Vulnerability published
Vulnerability Reserved
Credit
chumen77