CVE-2023-23369

QTS, Multimedia Console, and Media Streaming add-on

State: Published
Severity: 9.0 Critical
Published: Nov 3, 2023
Updated: Feb 27, 2025
Reserved: Jan 11, 2023

Description

An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow users to execute commands via a network.

We have already fixed the vulnerability in the following versions: Multimedia Console 2.1.2 ( 2023/05/04 ) and later Multimedia Console 1.4.8 ( 2023/05/05 ) and later QTS 5.1.0.2399 build 20230515 and later QTS 4.3.6.2441 build 20230621 and later QTS 4.3.4.2451 build 20230621 and later QTS 4.3.3.2420 build 20230621 and later QTS 4.2.6 build 20230621 and later Media Streaming add-on 500.1.1.2 ( 2023/06/12 ) and later Media Streaming add-on 500.0.0.11 ( 2023/06/16 ) and later

Scores

CVSS	Score	Vector	Source
3.1	9.0 Critical	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H	qnap

Weaknesses

Affected Products

Product	Versions
Multimedia ConsoleQNAP Systems Inc.	2.1.x to before 2.1.2 ( 2023/05/04 )Affected 1.4.x to before 1.4.8 ( 2023/05/05 )Affected
QTSQNAP Systems Inc.	5.1.x to before 5.1.0.2399 build 20230515Affected 4.3.6 to before 4.3.6.2441 build 20230621Affected 4.3.4 to before 4.3.4.2451 build 20230621Affected 4.3.3 to before 4.3.3.2420 build 20230621Affected 4.2.x to before 4.2.6 build 20230621Affected
Media Streaming add-onQNAP Systems Inc.	500.1.x to before 500.1.1.2 ( 2023/06/12 )Affected 500.0.x to before 500.0.0.11 ( 2023/06/16 )Affected

References

https://www.qnap.com/en/security-advisory/qsa-23-35

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.