Cyber Resilience

CVE-2023-23369

CriticalRCE

Published: 03 November 2023

Published
03 November 2023
Modified
21 November 2024
KEV Added
Patch
CVSS Score v3.1 9.0 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
EPSS Score 0.1181 93.9th percentile
Risk Priority 25 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2023-23369 is a critical-severity Command Injection (CWE-77) vulnerability in Qnap Qts. Its CVSS base score is 9.0 (Critical).

Operationally, ranked in the top 6.1% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

Deeper analysis

An OS command injection vulnerability tracked as CVE-2023-23369 affects multiple versions of QNAP QTS, Multimedia Console, and the Media Streaming add-on. The flaw, assigned CWE-77 and CWE-78, permits unauthenticated remote attackers to execute arbitrary operating-system commands over the network, carrying a CVSS 3.1 score of 9.0 that reflects high impact across confidentiality, integrity, and availability with changed scope.

Successful exploitation requires no credentials or user interaction, although the attack vector is rated with high complexity. An attacker positioned on the network can leverage the injection to run commands on the affected QNAP device, potentially leading to full system compromise.

QNAP has released fixed builds that remediate the issue, including Multimedia Console 2.1.2 and 1.4.8, QTS 5.1.0.2399 and later maintenance releases, several QTS 4.3.x and 4.2.6 builds from June 2023 onward, and Media Streaming add-on versions 500.1.1.2 and 500.0.0.11. The vendor advisory QSA-23-35 lists the precise updated builds and urges immediate installation.

The associated EPSS score has remained flat at 0.1181 with no material increase since disclosure.

EU & UK References

Vulnerability details

An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow users to execute commands via a network. We have already fixed the vulnerability in the following versions: Multimedia Console…

more

2.1.2 ( 2023/05/04 ) and later Multimedia Console 1.4.8 ( 2023/05/05 ) and later QTS 5.1.0.2399 build 20230515 and later QTS 4.3.6.2441 build 20230621 and later QTS 4.3.4.2451 build 20230621 and later QTS 4.3.3.2420 build 20230621 and later QTS 4.2.6 build 20230621 and later Media Streaming add-on 500.1.1.2 ( 2023/06/12 ) and later Media Streaming add-on 500.0.0.11 ( 2023/06/16 ) and later

CWE(s)

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

qnap
qts
4.2.6, 4.3.3.0174, 4.3.3.0868, 4.3.3.0998, 4.3.3.1051
qnap
multimedia console
1.4.3, 1.4.4, 1.4.5, 1.4.6, 1.4.7
qnap
media streaming add-on
500.0.0.0, 500.0.0.1, 500.0.0.10, 500.0.0.3, 500.0.0.4

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

addresses: CWE-78

Platform-independent apps typically execute inside a managed runtime or sandbox that restricts direct OS command execution, reducing the ability to exploit OS command injection.

addresses: CWE-78

Validates inputs to block special elements that would alter OS command execution.

References