PT-2023-9452 · Qnap · Qts

Arseniy Sharoglazov · Published 2023-08-15 · Updated 2024-09-24 · CVE-2023-39300

Positive Technologies (AI Summary)

CVSS v2.0

8.3

High

Base vector

AV:N/AC:L/Au:M/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions QTS versions prior to 4.3.6.2805 build 20240619 QTS versions prior to 4.3.4.2814 build 20240618 QTS versions prior to 4.3.3.2784 build 20240619 QTS versions prior to 4.2.6 build 20240618

Description An OS command injection vulnerability has been reported to affect legacy QTS. If exploited, the vulnerability could allow authenticated administrators to execute commands via a network. The issue is related to insufficient access control, which could allow a remote attacker to execute arbitrary code in the system.

Recommendations For versions prior to 4.3.6.2805 build 20240619, update to QTS 4.3.6.2805 build 20240619 or later. For versions prior to 4.3.4.2814 build 20240618, update to QTS 4.3.4.2814 build 20240618 or later. For versions prior to 4.3.3.2784 build 20240619, update to QTS 4.3.3.2784 build 20240619 or later. For versions prior to 4.2.6 build 20240618, update to QTS 4.2.6 build 20240618 or later.

Fix

OS Command Injection

Improper Access Control

Weakness Enumeration

CWE-78

CWE-284

Related Identifiers

BDU:2024-07678

CVE-2023-39300

Affected Products

Qts

References · 8

• https://osv.dev/vulnerability/CVE-2023-39300 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-39300 · Security Note
• https://bdu.fstec.ru/vul/2024-07678 · Security Note
• https://qnap.com/en/security-advisory/qsa-24-26 · Vendor Advisory
• https://twitter.com/CVEnew/status/1832097909413966233 · Twitter Post
• https://t.me/cvenotify/93771 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1832126535316226216 · Twitter Post
• https://t.me/cvenotify/95829 · Telegram Post