CVE-2023-23369: QTS, Multimedia Console, and Media Streaming add-on

Published Nov 3, 2023

Updated

An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow users to execute commands via a network.

We have already fixed the vulnerability in the following versions: Multimedia Console 2.1.2 ( 2023/05/04 ) and later Multimedia Console 1.4.8 ( 2023/05/05 ) and later QTS 5.1.0.2399 build 20230515 and later QTS 4.3.6.2441 build 20230621 and later QTS 4.3.4.2451 build 20230621 and later QTS 4.3.3.2420 build 20230621 and later QTS 4.2.6 build 20230621 and later Media Streaming add-on 500.1.1.2 ( 2023/06/12 ) and later Media Streaming add-on 500.0.0.11 ( 2023/06/16 ) and later

Affected Software

91 affected components

QNAP QTS=5.1.0.2348-build_20230325

QNAP QTS=4.3.6.0895-build_20190328

QNAP QTS=4.3.6.0907-build_20190409

QNAP QTS=4.3.6.0923-build_20190425

QNAP QTS=4.3.6.0944-build_20190516

QNAP QTS=4.3.6.0959-build_20190531

QNAP QTS=4.3.6.0979-build_20190620

QNAP QTS=4.3.6.0993-build_20190704

QNAP QTS=4.3.6.1013-build_20190724

QNAP QTS=4.3.6.1033-build_20190813

QNAP QTS=4.3.6.1070-build_20190919

QNAP QTS=4.3.6.1154-build_20191212

QNAP QTS=4.3.6.1218-build_20200214

QNAP QTS=4.3.6.1263-build_20200330

QNAP QTS=4.3.6.1286-build_20200422

QNAP QTS=4.3.6.1333-build_20200608

QNAP QTS=4.3.6.1411-build_20200825

QNAP QTS=4.3.6.1446-build_20200929

QNAP QTS=4.3.6.1620-build_20210322

QNAP QTS=4.3.6.1663-build_20210504

QNAP QTS=4.3.6.1711-build_20210621

QNAP QTS=4.3.6.1750-build_20210730

QNAP QTS=4.3.6.1831-build_20211019

QNAP QTS=4.3.6.1907-build_20220103

QNAP QTS=4.3.6.1965-build_20220302

QNAP QTS=4.3.6.2050-build_20220526

QNAP QTS=4.3.6.2232-build_20221124

QNAP QTS=4.3.4.0899-build_20190322

QNAP QTS=4.3.4.1029-build_20190730

QNAP QTS=4.3.4.1082-build_20190921

QNAP QTS=4.3.4.1190-build_20200107

QNAP QTS=4.3.4.1282-build_20200408

QNAP QTS=4.3.4.1368-build_20200703

QNAP QTS=4.3.4.1417-build_20200821

QNAP QTS=4.3.4.1463-build_20201006

QNAP QTS=4.3.4.1632-build_20210324

QNAP QTS=4.3.4.1652-build_20210413

QNAP QTS=4.3.4.1976-build_20220303

QNAP QTS=4.3.4.2107-build_20220712

QNAP QTS=4.3.4.2242-build_20221124

QNAP QTS=4.3.3.0174-build_20170503

QNAP QTS=4.3.3.0868-build_20190322

QNAP QTS=4.3.3.0998-build_20190730

QNAP QTS=4.3.3.1051-build_20190921

QNAP QTS=4.3.3.1098-build_20191107

QNAP QTS=4.3.3.1161-build_20200109

QNAP QTS=4.3.3.1252-build_20200409

QNAP QTS=4.3.3.1315-build_20200611

QNAP QTS=4.3.3.1386-build_20200821

QNAP QTS=4.3.3.1432-build_20201006

QNAP QTS=4.3.3.1624-build_20210416

QNAP QTS=4.3.3.1677-build_20210608

QNAP QTS=4.3.3.1693-build_20210624

QNAP QTS=4.3.3.1799-build_20211008

QNAP QTS=4.3.3.1864-build_20211212

QNAP QTS=4.3.3.1945-build_20220303

QNAP QTS=4.3.3.2057-build_20220623

QNAP QTS=4.3.3.2211-build_20221124

QNAP QTS=4.2.6-build_20170517

QNAP QTS=4.2.6-build_20190322

QNAP QTS=4.2.6-build_20190730

QNAP QTS=4.2.6-build_20190921

QNAP QTS=4.2.6-build_20191107

QNAP QTS=4.2.6-build_20200109

QNAP QTS=4.2.6-build_20200421

QNAP QTS=4.2.6-build_20200611

QNAP QTS=4.2.6-build_20200821

QNAP QTS=4.2.6-build_20210327

QNAP QTS=4.2.6-build_20211215

QNAP QTS=4.2.6-build_20220304

QNAP QTS=4.2.6-build_20220623

QNAP QTS=4.2.6-build_20221028

QNAP Multimedia Console=2.1.0

QNAP Multimedia Console=2.1.1

QNAP Multimedia Console=1.4.3

QNAP Multimedia Console=1.4.4

QNAP Multimedia Console=1.4.5

QNAP Multimedia Console=1.4.6

QNAP Multimedia Console=1.4.7

QNAP Media Streaming add-on=500.1.1.0

QNAP Media Streaming add-on=500.1.1.1

QNAP Media Streaming add-on=500.0.0.0

QNAP Media Streaming add-on=500.0.0.1

QNAP Media Streaming add-on=500.0.0.3

QNAP Media Streaming add-on=500.0.0.4

QNAP Media Streaming add-on=500.0.0.5

QNAP Media Streaming add-on=500.0.0.6

QNAP Media Streaming add-on=500.0.0.7

QNAP Media Streaming add-on=500.0.0.8

QNAP Media Streaming add-on=500.0.0.9

QNAP Media Streaming add-on=500.0.0.10

Remediation

Information

Event History

Nov 3, 2023

CVE Published

04:34 PM

Data Sourced

04:34 PM

RemedyDescriptionSeverityWeakness

Frequently Asked Questions

What is CVE-2023-23369?

CVE-2023-23369 is an OS command injection vulnerability affecting QTS Multimedia Console and Media Streaming add-on by QNAP.

What is the severity of CVE-2023-23369?

The severity of CVE-2023-23369 is rated as critical with a severity value of 9.

Which versions of QTS Multimedia Console are affected by CVE-2023-23369?

Versions 2.1.0, 2.1.1, 1.4.3, 1.4.4, 1.4.5, 1.4.6, and 1.4.7 are affected by CVE-2023-23369.

How can I fix CVE-2023-23369 vulnerability?

The vulnerability has been fixed in Multimedia Console version 2.1.2 released on May 4, 2023.

Where can I find more information about CVE-2023-23369?

You can find more information about CVE-2023-23369 in the QNAP security advisory QSA-23-35.