PT-2023-7828 · Qnap · Multimedia Console

H4Lo · Published 2023-09-21 · Updated 2023-09-26 · CVE-2023-23364

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Multimedia Console versions prior to 1.4.7 Multimedia Console versions prior to 2.1.1

Description A buffer copy without checking size of input vulnerability has been reported to affect QNAP operating systems. If exploited, the vulnerability possibly allows remote users to execute code via unspecified vectors.

Recommendations For Multimedia Console versions prior to 1.4.7, update to version 1.4.7 or later. For Multimedia Console versions prior to 2.1.1, update to version 2.1.1 or later.

Fix

Buffer Overflow

Weakness Enumeration

CWE-120

Related Identifiers

BDU:2023-08899

CVE-2023-23364

Affected Products

Multimedia Console

References · 12

• https://qnap.com/en/security-advisory/qsa-23-29 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-23364 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-23364 · Security Note
• https://bdu.fstec.ru/vul/2023-08899 · Security Note
• https://t.me/cibsecurity/70936 · Telegram Post
• https://t.me/pentestingnews/39570 · Telegram Post
• https://twitter.com/Komodosec/status/1705199781419893044 · Twitter Post
• https://twitter.com/CVEnew/status/1705073988429357500 · Twitter Post
• https://t.me/cvenotify/58406 · Telegram Post
• https://twitter.com/fridaysecurity/status/1705125467877978395 · Twitter Post
• https://twitter.com/the_yellow_fall/status/1705123317320180107 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1705092339767685353 · Twitter Post