CVE-2023-23362: QTS, QuTS hero, QuTScloud
An OS command injection vulnerability has been reported to affect QNAP operating systems. If exploited, the vulnerability allows remote authenticated users to execute commands via susceptible QNAP devices.
We have already fixed the vulnerability in the following versions: QTS 5.0.1.2376 build 20230421 and later QTS 4.5.4.2374 build 20230416 and later QuTS hero h5.0.1.2376 build 20230421 and later QuTS hero h4.5.4.2374 build 20230417 and later QuTScloud c5.0.1.2374 and later
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is CVE-2023-23362?
CVE-2023-23362 is an OS command injection vulnerability that affects QNAP operating systems.
How does CVE-2023-23362 affect QNAP operating systems?
If exploited, the vulnerability allows remote authenticated users to execute commands via susceptible QNAP devices.
Which versions of QNAP operating systems are affected by CVE-2023-23362?
QNAP QTS versions 4.5.4.2374 and lower, and QNAP Quts Hero versions h4.5.4.2374 and lower are affected.
What is the severity of CVE-2023-23362?
CVE-2023-23362 has a severity of 8.8 (high).
How can I fix CVE-2023-23362?
The vulnerability has been fixed in QTS version 5.0.1.2376 and Quts Hero version h5.0.1.2376. Update your QNAP operating system to the latest fixed version.