PT-2023-25079 · Qnap · Qnap Qts+1

0X14Rev + 2 · Publicado 2023-10-13 · Atualizado 2026-01-12 · CVE-2023-34975

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions QNAP QuTS hero versions prior to h4.5.4.2626 build 20231225 QNAP QTS versions prior to 4.5.4.2627 build 20231225

Description An OS command injection issue has been reported, affecting several QNAP operating system versions. This could allow authenticated administrators to execute commands via a network.

Recommendations For QNAP QuTS hero versions prior to h4.5.4.2626 build 20231225, update to version h4.5.4.2626 build 20231225 or later. For QNAP QTS versions prior to 4.5.4.2627 build 20231225, update to version 4.5.4.2627 build 20231225 or later.

Correção

OS Command Injection

SQL injection

Enumeração de Fraquezas

CWE-78

CWE-89

Identificadores relacionados

CVE-2023-34975

Produtos afetados

Qnap Qts

Qnap Quts Hero

Referências · 5

• https://nvd.nist.gov/vuln/detail/CVE-2023-34975 · Nota de Segurança
• https://qnap.com/en/security-advisory/qsa-24-12 · Nota
• https://t.me/cvenotify/73384 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2023-34975 · Aviso do Fabricante
• https://t.me/cveNotify/148399 · Publicação no Telegram