PT-2024-1515 · Qnap · Qts+2

Chumen77 · Published 2024-02-02 · Updated 2024-02-26 · CVE-2023-45025

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions QTS versions prior to 5.1.4.2596 build 20231128 QTS versions prior to 4.5.4.2627 build 20231225 QuTS hero versions prior to h5.1.4.2596 build 20231128 QuTS hero versions prior to h4.5.4.2626 build 20231225 QuTScloud versions prior to c5.1.5.2651

Description The issue exists due to the lack of measures to neutralize special elements used in the operating system command. Exploitation of this issue could allow a remote attacker to execute arbitrary commands.

Recommendations For QTS versions prior to 5.1.4.2596 build 20231128, update to version 5.1.4.2596 build 20231128 or later. For QTS versions prior to 4.5.4.2627 build 20231225, update to version 4.5.4.2627 build 20231225 or later. For QuTS hero versions prior to h5.1.4.2596 build 20231128, update to version h5.1.4.2596 build 20231128 or later. For QuTS hero versions prior to h4.5.4.2626 build 20231225, update to version h4.5.4.2626 build 20231225 or later. For QuTScloud versions prior to c5.1.5.2651, update to version c5.1.5.2651 or later.

Fix

OS Command Injection

Command Injection

Weakness Enumeration

CWE-78

CWE-77

Related Identifiers

BDU:2024-01026

CVE-2023-45025

Affected Products

Qts

Quts Hero

Qutscloud

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2023-45025 · Security Note
• https://qnap.com/en/security-advisory/qsa-23-47 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-01026 · Security Note
• https://osv.dev/vulnerability/CVE-2023-45025 · Vendor Advisory
• https://t.me/cvenotify/70566 · Telegram Post
• https://twitter.com/CCBalert/status/1762131065014046853 · Twitter Post
• https://twitter.com/LeVPN/status/1756621583198703899 · Twitter Post
• https://twitter.com/CVEnew/status/1753452522453279135 · Twitter Post