QTS, QuTS hero, QuTScloud
CVE-2023-45025

9CRITICAL

Key Information:

Vendor

QNAP
Status
Qts
Quts Hero
Qutscloud
Vendor
CVE Published:
2 February 2024

What is CVE-2023-45025?

An OS command injection vulnerability has been identified in multiple QNAP operating system versions. This flaw allows attackers to execute arbitrary commands through network access, potentially compromising the integrity and security of affected systems. Preventive measures and patch updates have been released to mitigate the risk associated with this vulnerability. Users are advised to update to the latest versions to ensure protection against unauthorized access and command execution.

Affected Version(s)

QTS 5.1.x < 5.1.4.2596 build 20231128

QTS 4.5.x < 4.5.4.2627 build 20231225

QuTS hero h5.1.x

References

https://www.qnap.com/en/security-advisory/qsa-23-47

CVSS V3.1

Score:
9
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

chumen77
.
CVE-2023-45025 : QTS, QuTS hero, QuTScloud