What is CVE-2023-23355?

CVE-2023-23355 is a medium-severity vulnerability in Qnap Qts, classified under Command Injection. CVSS score: 6.6/10. Published 2023-03-29.

How severe is CVE-2023-23355?

Medium severity. CVSS v3 base score is 6.6 out of 10.

RCE in Qnap Qts

CVE-2023-23355

An OS command injection vulnerability has been reported to affect QNAP operating systems. If exploited, the vulnerability possibly allows remote authenticated administrators to execute commands via unspecified vectors. QES is not affected…

Vulnerability class: Command Injection (OS Command Injection)

EPSS: 0.012 (65.5th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 6.6 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L.

Affected products

Qnap Qts
Qnap Qutscloud
Qnap Quts_hero
Qnap Qvp-21a
Qnap Qvp-21a_firmware
Qnap Qvp-41a
Qnap Qvp-41a_firmware
Qnap Qvp-41b
Qnap Qvp-41b_firmware
Qnap Qvp-63a

Weakness classification (CWE)

CWE-77 — Command Injection
CWE-78 — OS Command Injection

References

security@qnapsecurity.com.tw (Vendor Advisory)

Frequently asked questions

What is CVE-2023-23355?: CVE-2023-23355 is a medium-severity vulnerability in Qnap Qts, classified under Command Injection. CVSS score: 6.6/10. Published 2023-03-29.
How severe is CVE-2023-23355?: Medium severity. CVSS v3 base score is 6.6 out of 10.