PT-2023-9811 · Qnap · Qufirewall

Kaibro · Publicado 2023-09-08 · Atualizado 2024-12-19 · CVE-2023-23356

Positive Technologies (AI Summary)

CVSS v3.1

7.2

Alta

Vetor base

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions QuFirewall versions prior to 2.3.3

Description A command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote attackers who have gained administrator access to execute arbitrary commands.

Recommendations For QuFirewall versions prior to 2.3.3, update to version 2.3.3 or later to resolve the issue. As a temporary workaround, consider restricting access to the QuFirewall module to minimize the risk of exploitation.

Correção

OS Command Injection

Command Injection

Enumeração de Fraquezas

CWE-78

CWE-77

Identificadores relacionados

BDU:2024-11470

CVE-2023-23356

Produtos afetados

Qufirewall

Referências · 8

• https://qnap.com/en/security-advisory/qsa-23-14 · Aviso do Fabricante
• https://t.me/cvedetector/13306 · Publicação no Telegram
• https://t.me/cvenotify/104858 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2023-23356 · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2024-11470 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2023-23356 · Nota de Segurança
• https://twitter.com/VulmonFeeds/status/1869593701191717196 · Publicação no Twitter
• https://twitter.com/CVEnew/status/1869573125567873228 · Publicação no Twitter