Skip to content
OpenAdvisories
High WID-SEC-2023-2829 3 CVEs

QNAP NAS: Mehrere Schwachstellen

Published Nov 5, 2023 · Updated Nov 5, 2023 · de-DE

Vendor: QNAP Systems Product: NAS Product: NAS < QTS 4.2.6 build 20230621 Product: NAS < QTS 4.3.3.2420 build 20230621 Product: NAS < QTS 4.3.4.2451 build 20230621 Product: NAS < QTS 4.3.6.2441 build 20230621 Product: NAS < QTS 4.5.4.2374 build 20230416 Product: NAS < QTS 5.0.1.2376 build 20230421 Product: NAS < QTS 5.0.1.2514 build 20230906 Product: NAS < QTS 5.1.0.2399 build 20230515 Product: NAS < QTS 5.1.1.2491 build 20230815 Product: NAS < QuTS hero h4.5.4.2374 build 20230417 Product: NAS < QuTS hero h5.0.1.2376 build 20230421 Product: NAS < QuTS hero h5.1.1.2488 build 20230812 Product: NAS < QuTScloud c5.0.1.2374 Product: NAS QuTS hero < h5.0.1.2515 build 20230907 Product: NAS QuTScloud < c5.1.0.2498

Summary

Ein entfernter Angreifer kann mehrere Schwachstellen in QNAP NAS ausnutzen, um beliebigen Code auszuführen oder vertrauliche Informationen offenzulegen.

Product

QNAP ist ein Hersteller von NAS (Network Attached Storage) Lösungen.

Vulnerabilities 3

  • Critical 9.8
    CVE-2023-23368 EPSS 18%

    QTS, QuTS hero, QuTScloud

    An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow users to execute commands via a network. We have already fixed the vulnerability in the following versions: Q…

    QNAP Systems QTS QuTS hero QuTScloud
  • Critical 9.0
    CVE-2023-23369 EPSS 14%

    QTS, Multimedia Console, and Media Streaming add-on

    An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow users to execute commands via a network. We have already fixed the vulnerability in the following versions: M…

    QNAP Systems QTS Media Streaming Add-on Multimedia Console
  • Medium 4.3
    CVE-2023-39301

    QTS, QuTS hero, QuTScloud

    A server-side request forgery (SSRF) vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated users to read application data via a network. We have already fixed the vulnerabil…

    QNAP Systems QTS QuTS hero QuTScloud

Revision history

  1. #1

    Initiale Fassung

References