Lucene search

K
cve[email protected]CVE-2023-41281
HistoryFeb 02, 2024 - 4:15 p.m.

CVE-2023-41281

2024-02-0216:15:49
CWE-78
CWE-77
web.nvd.nist.gov
10
20
cve-2023-41281
os command injection
qnap
vulnerability
security fix
nvd

7.2 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

7.4 High

AI Score

Confidence

High

0.0005 Low

EPSS

Percentile

17.3%

An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated administrators to execute commands via a network.

We have already fixed the vulnerability in the following versions:
QTS 5.1.4.2596 build 20231128 and later
QuTS hero h5.1.4.2596 build 20231128 and later
QuTScloud c5.1.5.2651 and later

Affected configurations

NVD
Node
qnapqtsMatch5.1.0.2348build_20230325
OR
qnapqtsMatch5.1.0.2399build_20230515
OR
qnapqtsMatch5.1.0.2418build_20230603
OR
qnapqtsMatch5.1.0.2444build_20230629
OR
qnapqtsMatch5.1.0.2466build_20230721
OR
qnapqtsMatch5.1.1.2491build_20230815
OR
qnapqtsMatch5.1.2.2533build_20230926
OR
qnapqtsMatch5.1.3.2578build_20231110
OR
qnapqtsMatch5.1.4.2596
OR
qnapquts_heroMatchh5.1.0.2409build_20230525
OR
qnapquts_heroMatchh5.1.0.2424build_20230609
OR
qnapquts_heroMatchh5.1.0.2453build_20230708
OR
qnapquts_heroMatchh5.1.0.2466build_20230721
OR
qnapquts_heroMatchh5.1.1.2488build_20230812
OR
qnapquts_heroMatchh5.1.2.2534build_20230927
OR
qnapquts_heroMatchh5.1.3.2578build_20231110
OR
qnapquts_heroMatchh5.1.4.2596-
OR
qnapqutscloudMatchc5.1.0.2498build_20230822

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "QTS",
    "vendor": "QNAP Systems Inc.",
    "versions": [
      {
        "lessThan": "5.1.4.2596 build 20231128",
        "status": "affected",
        "version": "5.1.x",
        "versionType": "custom"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "product": "QuTS hero",
    "vendor": "QNAP Systems Inc.",
    "versions": [
      {
        "lessThan": "h5.1.4.2596 build 20231128",
        "status": "affected",
        "version": "h5.1.x",
        "versionType": "custom"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "product": "QuTScloud",
    "vendor": "QNAP Systems Inc.",
    "versions": [
      {
        "lessThan": "c5.1.5.2651",
        "status": "affected",
        "version": "c5.x.x",
        "versionType": "custom"
      }
    ]
  }
]

Social References

More

7.2 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

7.4 High

AI Score

Confidence

High

0.0005 Low

EPSS

Percentile

17.3%

Related for CVE-2023-41281