Medium WID-SEC-2024-0353 2 CVEs

QNAP NAS: Mehrere Schwachstellen ermöglichen Codeausführung

Published Feb 12, 2024 · Updated Feb 22, 2024 · Revision 3 · de-DE

Vendor: QNAP Systems Product: NAS Platform: Linux Platform: Windows

Summary

Ein Angreifer aus dem lokalen Netzwerk kann mehrere Schwachstellen in QNAP NAS ausnutzen, um beliebigen Programmcode auszuführen.

Product

QNAP ist ein Hersteller von NAS (Network Attached Storage) Lösungen.

Vulnerabilities 2

Medium 5.8

CVE-2023-47218 Public exploit Scanner template EPSS 90%

QTS, QuTS hero, QuTScloud

An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow users to execute commands via a network. We have already fixed the vulnerability in the following versions: Q…

QNAP Systems QTS QuTS hero QuTScloud

Feb 13, 2024
Medium 5.8

CVE-2023-50358 EPSS 14%

QTS, QuTS hero, QuTScloud

An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow users to execute commands via a network. We have already fixed the vulnerability in the following versions: Q…

QNAP Systems QTS QuTS hero QuTScloud

Feb 13, 2024

Revision history

2024-02-22 #3
Exploit aufgenommen
2024-02-13 #2
Korrektur Angriffsvektor + Authentisierung
2024-02-12 #1
Initiale Fassung

References

GitHub Advisory Database vom 2024-02-12
https://github.com/advisories/GHSA-975j-m6j8-qh4v
QNAP Security Advisory vom 2024-02-12
https://www.qnap.com/en/security-advisory/qsa-23-57
Exploitalert.com vom 2024-02-22
https://exploitalert.com/view-details/qnap-qts-quts-hero-unauthenticated-remote-code-execution