Cyber Resilience

CVE-2023-23355

Medium

Published: 29 March 2023

Published
29 March 2023
Modified
21 November 2024
KEV Added
Patch
CVSS Score v3.1 6.6 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L
EPSS Score 0.0061 70.2th percentile
Risk Priority 14 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2023-23355 is a medium-severity Command Injection (CWE-77) vulnerability in Qnap Qvr. Its CVSS base score is 6.6 (Medium).

Operationally, ranked in the top 29.8% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

EU & UK References

Vulnerability details

An OS command injection vulnerability has been reported to affect QNAP operating systems. If exploited, the vulnerability possibly allows remote authenticated administrators to execute commands via unspecified vectors. QES is not affected. We have already fixed the vulnerability in the…

more

following versions: QTS 5.0.1.2346 build 20230322 and later QTS 4.5.4.2374 build 20230416 and later QuTS hero h5.0.1.2348 build 20230324 and later QuTS hero h4.5.4.2374 build 20230417 and later QuTScloud c5.0.1.2374 and later

CWE(s)

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

qnap
qvr
all versions
qnap
qts
≤ 5.0.1.2346
qnap
quts hero
≤ h5.0.1.2348
qnap
qutscloud
all versions
qnap
qvp-41b firmware
all versions
qnap
qvp-63b firmware
all versions
qnap
qvp-85b firmware
all versions
qnap
qvp-21a firmware
all versions
qnap
qvp-41a firmware
all versions
qnap
qvp-63a firmware
all versions
+1 more product configuration(s) — see NVD for full list

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

addresses: CWE-78

Platform-independent apps typically execute inside a managed runtime or sandbox that restricts direct OS command execution, reducing the ability to exploit OS command injection.

addresses: CWE-78

Validates inputs to block special elements that would alter OS command execution.

References