CVE-2023-34975: QTS, QuTS hero, QuTScloud
A SQL injection vulnerability has been reported to affect Video Station. If exploited, the vulnerability could allow authenticated users to inject malicious code via a network.
We have already fixed the vulnerability in the following version: Video Station 5.7.0 ( 2023/07/27 ) and later
Other sources
An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated administrators to execute commands via a network. QuTScloud is not affected.
We have already fixed the vulnerability in the following versions: QuTS hero h4.5.4.2626 build 20231225 and later QTS 4.5.4.2627 build 20231225 and later
— MITRE
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is the vulnerability ID for this SQL injection vulnerability?
The vulnerability ID for this SQL injection vulnerability is CVE-2023-34975.
What software is affected by this vulnerability?
The software affected by this vulnerability is QNAP Video Station.
What is the severity of CVE-2023-34975?
The severity of CVE-2023-34975 is high, with a severity value of 8.8.
How can this vulnerability be exploited?
This vulnerability can be exploited by authenticated users injecting malicious code via a network.
How can I fix CVE-2023-34975?
To fix CVE-2023-34975, upgrade to Video Station 5.7.0 (2023/07/27) or later versions.