PT-2023-6780 · Qnap · Media Streaming Add-On+2

Eqqie

·

Publicado

2023-11-03

·

Atualizado

2023-11-15

·

CVE-2023-23369

CVSS v3.1

9.8

Crítica

VetorAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions QTS versions prior to 5.1.0.2399 build 20230515 QTS versions prior to 4.3.6.2441 build 20230621 QTS versions prior to 4.3.4.2451 build 20230621 QTS versions prior to 4.3.3.2420 build 20230621 QTS versions prior to 4.2.6 build 20230621 Multimedia Console versions prior to 2.1.2 Multimedia Console versions prior to 1.4.8 Media Streaming add-on versions prior to 500.1.1.2 Media Streaming add-on versions prior to 500.0.0.11
Description The issue is related to an OS command injection vulnerability that affects several QNAP operating system versions. If exploited, it could allow users to execute commands via a network.
Recommendations Update QTS to version 5.1.0.2399 build 20230515 or later. Update QTS to version 4.3.6.2441 build 20230621 or later. Update QTS to version 4.3.4.2451 build 20230621 or later. Update QTS to version 4.3.3.2420 build 20230621 or later. Update QTS to version 4.2.6 build 20230621 or later. Update Multimedia Console to version 2.1.2 or later. Update Multimedia Console to version 1.4.8 or later. Update Media Streaming add-on to version 500.1.1.2 or later. Update Media Streaming add-on to version 500.0.0.11 or later.

Correção

OS Command Injection

Command Injection

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-78CWE-77

Identificadores relacionados

BDU:2023-07599
CVE-2023-23369

Produtos afetados

Media Streaming Add-On
Multimedia Console
Qts