CVE-2023-23355: QTS, QuTS hero, QuTScloud, QVP (QVR Pro appliances), QVR
An OS command injection vulnerability has been reported to affect QNAP operating systems. If exploited, the vulnerability possibly allows remote authenticated administrators to execute commands via unspecified vectors. QES is not affected.
We have already fixed the vulnerability in the following versions: QTS 5.0.1.2346 build 20230322 and later QTS 4.5.4.2374 build 20230416 and later QuTS hero h5.0.1.2348 build 20230324 and later QuTS hero h4.5.4.2374 build 20230417 and later QuTScloud c5.0.1.2374 and later
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
Which operating systems are affected by CVE-2023-23355?
QNAP QTS, Qnap Quts Hero, Qnap Qutscloud, Qnap Qvr, Qnap Qvp-41b Firmware, Qnap Qvp-63b Firmware, Qnap Qvp-85b Firmware, Qnap Qvp-21a Firmware, Qnap Qvp-41a Firmware, Qnap Qvp-63a Firmware, Qnap Qvp-85a Firmware.
What is the severity of CVE-2023-23355?
The severity of CVE-2023-23355 is high with a CVSS score of 7.2.
How can the CVE-2023-23355 vulnerability be exploited?
The CVE-2023-23355 vulnerability can be exploited by remote authenticated administrators via unspecified vectors to execute commands.
Which versions of QNAP QTS are affected by CVE-2023-23355?
Versions up to exclusive 5.0.1.2346 of QNAP QTS are affected by CVE-2023-23355.
Has QES been affected by CVE-2023-23355?
No, QES has not been affected by CVE-2023-23355.