critical
9.8
CWE
77 78
Advisory Published
Updated

CVE-2023-23369: QTS, Multimedia Console, and Media Streaming add-on

First published: Fri Nov 03 2023(Updated: )

An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow users to execute commands via a network. We have already fixed the vulnerability in the following versions: Multimedia Console 2.1.2 ( 2023/05/04 ) and later Multimedia Console 1.4.8 ( 2023/05/05 ) and later QTS 5.1.0.2399 build 20230515 and later QTS 4.3.6.2441 build 20230621 and later QTS 4.3.4.2451 build 20230621 and later QTS 4.3.3.2420 build 20230621 and later QTS 4.2.6 build 20230621 and later Media Streaming add-on 500.1.1.2 ( 2023/06/12 ) and later Media Streaming add-on 500.0.0.11 ( 2023/06/16 ) and later

Credit: security@qnapsecurity.com.tw

Affected SoftwareAffected VersionHow to fix
QNAP QTS=5.1.0.2348-build_20230325
QNAP QTS=4.3.6.0895-build_20190328
QNAP QTS=4.3.6.0907-build_20190409
QNAP QTS=4.3.6.0923-build_20190425
QNAP QTS=4.3.6.0944-build_20190516
QNAP QTS=4.3.6.0959-build_20190531
QNAP QTS=4.3.6.0979-build_20190620
QNAP QTS=4.3.6.0993-build_20190704
QNAP QTS=4.3.6.1013-build_20190724
QNAP QTS=4.3.6.1033-build_20190813
QNAP QTS=4.3.6.1070-build_20190919
QNAP QTS=4.3.6.1154-build_20191212
QNAP QTS=4.3.6.1218-build_20200214
QNAP QTS=4.3.6.1263-build_20200330
QNAP QTS=4.3.6.1286-build_20200422
QNAP QTS=4.3.6.1333-build_20200608
QNAP QTS=4.3.6.1411-build_20200825
QNAP QTS=4.3.6.1446-build_20200929
QNAP QTS=4.3.6.1620-build_20210322
QNAP QTS=4.3.6.1663-build_20210504
QNAP QTS=4.3.6.1711-build_20210621
QNAP QTS=4.3.6.1750-build_20210730
QNAP QTS=4.3.6.1831-build_20211019
QNAP QTS=4.3.6.1907-build_20220103
QNAP QTS=4.3.6.1965-build_20220302
QNAP QTS=4.3.6.2050-build_20220526
QNAP QTS=4.3.6.2232-build_20221124
QNAP QTS=4.3.4.0899-build_20190322
QNAP QTS=4.3.4.1029-build_20190730
QNAP QTS=4.3.4.1082-build_20190921
QNAP QTS=4.3.4.1190-build_20200107
QNAP QTS=4.3.4.1282-build_20200408
QNAP QTS=4.3.4.1368-build_20200703
QNAP QTS=4.3.4.1417-build_20200821
QNAP QTS=4.3.4.1463-build_20201006
QNAP QTS=4.3.4.1632-build_20210324
QNAP QTS=4.3.4.1652-build_20210413
QNAP QTS=4.3.4.1976-build_20220303
QNAP QTS=4.3.4.2107-build_20220712
QNAP QTS=4.3.4.2242-build_20221124
QNAP QTS=4.3.3.0174-build_20170503
QNAP QTS=4.3.3.0868-build_20190322
QNAP QTS=4.3.3.0998-build_20190730
QNAP QTS=4.3.3.1051-build_20190921
QNAP QTS=4.3.3.1098-build_20191107
QNAP QTS=4.3.3.1161-build_20200109
QNAP QTS=4.3.3.1252-build_20200409
QNAP QTS=4.3.3.1315-build_20200611
QNAP QTS=4.3.3.1386-build_20200821
QNAP QTS=4.3.3.1432-build_20201006
QNAP QTS=4.3.3.1624-build_20210416
QNAP QTS=4.3.3.1677-build_20210608
QNAP QTS=4.3.3.1693-build_20210624
QNAP QTS=4.3.3.1799-build_20211008
QNAP QTS=4.3.3.1864-build_20211212
QNAP QTS=4.3.3.1945-build_20220303
QNAP QTS=4.3.3.2057-build_20220623
QNAP QTS=4.3.3.2211-build_20221124
QNAP QTS=4.2.6-build_20170517
QNAP QTS=4.2.6-build_20190322
QNAP QTS=4.2.6-build_20190730
QNAP QTS=4.2.6-build_20190921
QNAP QTS=4.2.6-build_20191107
QNAP QTS=4.2.6-build_20200109
QNAP QTS=4.2.6-build_20200421
QNAP QTS=4.2.6-build_20200611
QNAP QTS=4.2.6-build_20200821
QNAP QTS=4.2.6-build_20210327
QNAP QTS=4.2.6-build_20211215
QNAP QTS=4.2.6-build_20220304
QNAP QTS=4.2.6-build_20220623
QNAP QTS=4.2.6-build_20221028
Qnap Multimedia Console=2.1.0
Qnap Multimedia Console=2.1.1
Qnap Multimedia Console=1.4.3
Qnap Multimedia Console=1.4.4
Qnap Multimedia Console=1.4.5
Qnap Multimedia Console=1.4.6
Qnap Multimedia Console=1.4.7
Qnap Media Streaming Add-on=500.1.1.0
Qnap Media Streaming Add-on=500.1.1.1
Qnap Media Streaming Add-on=500.0.0.0
Qnap Media Streaming Add-on=500.0.0.1
Qnap Media Streaming Add-on=500.0.0.3
Qnap Media Streaming Add-on=500.0.0.4
Qnap Media Streaming Add-on=500.0.0.5
Qnap Media Streaming Add-on=500.0.0.6
Qnap Media Streaming Add-on=500.0.0.7
Qnap Media Streaming Add-on=500.0.0.8
Qnap Media Streaming Add-on=500.0.0.9
Qnap Media Streaming Add-on=500.0.0.10

Remedy

We have already fixed the vulnerability in the following versions: Multimedia Console 2.1.2 ( 2023/05/04 ) and later Multimedia Console 1.4.8 ( 2023/05/05 ) and later QTS 5.1.0.2399 build 20230515 and later QTS 4.3.6.2441 build 20230621 and later QTS 4.3.4.2451 build 20230621 and later QTS 4.3.3.2420 build 20230621 and later QTS 4.2.6 build 20230621 and later Media Streaming add-on 500.1.1.2 ( 2023/06/12 ) and later Media Streaming add-on 500.0.0.11 ( 2023/06/16 ) and later

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.

Read MoreStart Free Trial

Reference Links

Frequently Asked Questions

  • What is CVE-2023-23369?

    CVE-2023-23369 is an OS command injection vulnerability affecting QTS Multimedia Console and Media Streaming add-on by QNAP.

  • What is the severity of CVE-2023-23369?

    The severity of CVE-2023-23369 is rated as critical with a severity value of 9.

  • Which versions of QTS Multimedia Console are affected by CVE-2023-23369?

    Versions 2.1.0, 2.1.1, 1.4.3, 1.4.4, 1.4.5, 1.4.6, and 1.4.7 are affected by CVE-2023-23369.

  • How can I fix CVE-2023-23369 vulnerability?

    The vulnerability has been fixed in Multimedia Console version 2.1.2 released on May 4, 2023.

  • Where can I find more information about CVE-2023-23369?

    You can find more information about CVE-2023-23369 in the QNAP security advisory QSA-23-35.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2025 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203