CVE-2023-23368: QTS, QuTS hero, QuTScloud

Published Nov 3, 2023

Updated

An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow users to execute commands via a network.

We have already fixed the vulnerability in the following versions: QTS 5.0.1.2376 build 20230421 and later QTS 4.5.4.2374 build 20230416 and later QuTS hero h5.0.1.2376 build 20230421 and later QuTS hero h4.5.4.2374 build 20230417 and later QuTScloud c5.0.1.2374 and later

Affected Software

45 affected components

QNAP QTS=5.0.1

QNAP QTS=5.0.1.2034-build_20220515

QNAP QTS=5.0.1.2079-build_20220629

QNAP QTS=5.0.1.2131-build_20220820

QNAP QTS=5.0.1.2137-build_20220826

QNAP QTS=5.0.1.2145-build_20220903

QNAP QTS=5.0.1.2173-build_20221001

QNAP QTS=5.0.1.2194-build_20221022

QNAP QTS=5.0.1.2234-build_20221201

QNAP QTS=5.0.1.2248-build_20221215

QNAP QTS=5.0.1.2277-build_20230112

QNAP QTS=5.0.1.2346-build_20230322

QNAP QTS=4.5.4

QNAP QTS=4.5.4.1715-build_20210630

QNAP QTS=4.5.4.1723-build_20210708

QNAP QTS=4.5.4.1741-build_20210726

QNAP QTS=4.5.4.1787-build_20210910

QNAP QTS=4.5.4.1800-build_20210923

QNAP QTS=4.5.4.1892-build_20211223

QNAP QTS=4.5.4.1931-build_20220128

QNAP QTS=4.5.4.2012-build_20220419

QNAP QTS=4.5.4.2117-build_20220802

QNAP QTS=4.5.4.2280-build_20230112

QNAP QuTS hero=h5.0.1.2045-build_20220526

QNAP QuTS hero=h5.0.1.2192-build_20221020

QNAP QuTS hero=h5.0.1.2248-build_20221215

QNAP QuTS hero=h5.0.1.2269-build_20230104

QNAP QuTS hero=h5.0.1.2277-build_20230112

QNAP QuTS hero=h5.0.1.2348-build_20230324

QNAP QuTS hero=h4.5.4.1771-build_20210825

QNAP QuTS hero=h4.5.4.1800-build_20210923

QNAP QuTS hero=h4.5.4.1813-build_20211006

QNAP QuTS hero=h4.5.4.1848-build_20211109

QNAP QuTS hero=h4.5.4.1892-build_20211223

QNAP QuTS hero=h4.5.4.1951-build_20220218

QNAP QuTS hero=h4.5.4.1971-build_20220310

QNAP QuTS hero=h4.5.4.1991-build_20220330

QNAP QuTS hero=h4.5.4.2052-build_20220530

QNAP QuTS hero=h4.5.4.2138-build_20220824

QNAP QuTS hero=h4.5.4.2217-build_20221111

QNAP QuTS hero=h4.5.4.2272-build_20230105

QNAP QuTScloud=c5.0.1.1949-build_20220218

QNAP QuTScloud=c5.0.1.1998-build_20220408

QNAP QuTScloud=c5.0.1.2044-build_20220524

QNAP QuTScloud=c5.0.1.2148-build_20220905

Remediation

Information

Event History

Nov 3, 2023

CVE Published

04:34 PM

Data Sourced

04:34 PM

RemedyDescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2023-23368?

CVE-2023-23368 is classified as a high severity OS command injection vulnerability that could allow unauthorized command execution through the network.

How do I fix CVE-2023-23368?

To fix CVE-2023-23368, upgrade to the patched version of QTS, specifically versions beyond 5.0.1.2376 or 4.5.4.2280.

Which QNAP software versions are affected by CVE-2023-23368?

CVE-2023-23368 affects several versions of QNAP QTS 4.5.4 and 5.0.1 series including specific builds mentioned in the advisory.

Can CVE-2023-23368 be exploited remotely?

Yes, CVE-2023-23368 can be exploited remotely if an attacker has network access to the vulnerable QNAP devices.

Is there a workaround for CVE-2023-23368?

No specific workaround is available for CVE-2023-23368; the recommended action is to update to the latest secure version.