Skip to content
CVE PROGRAM SOURCE RECORD9.0 Critical

CVE-2023-23369

QTS, Multimedia Console, and Media Streaming add-on

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
qnap

Description

An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow users to execute commands via a network. We have already fixed the vulnerability in the following versions: Multimedia Console 2.1.2 ( 2023/05/04 ) and later Multimedia Console 1.4.8 ( 2023/05/05 ) and later QTS 5.1.0.2399 build 20230515 and later QTS 4.3.6.2441 build 20230621 and later QTS 4.3.4.2451 build 20230621 and later QTS 4.3.3.2420 build 20230621 and later QTS 4.2.6 build 20230621 and later Media Streaming add-on 500.1.1.2 ( 2023/06/12 ) and later Media Streaming add-on 500.0.0.11 ( 2023/06/16 ) and later

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

QNAP Systems Inc. Multimedia Console

Default version status: unaffected

  • 2.1.x to < 2.1.2 ( 2023/05/04 )affected
  • 1.4.x to < 1.4.8 ( 2023/05/05 )affected

QNAP Systems Inc. QTS

Default version status: unaffected

  • 5.1.x to < 5.1.0.2399 build 20230515affected
  • 4.3.6 to < 4.3.6.2441 build 20230621affected
  • 4.3.4 to < 4.3.4.2451 build 20230621affected
  • 4.3.3 to < 4.3.3.2420 build 20230621affected
  • 4.2.x to < 4.2.6 build 20230621affected

QNAP Systems Inc. Media Streaming add-on

Default version status: unaffected

  • 500.1.x to < 500.1.1.2 ( 2023/06/12 )affected
  • 500.0.x to < 500.0.0.11 ( 2023/06/16 )affected

References