CVE-2023-23356 — Command Injection in Systems INC Qufirewall

CWE-77 — Command InjectionCWE-78 — OS Command Injection3 documents3 sources
Severity
7.2HIGHNVD
CNA5.5
EPSS
0.1%
top 68.43%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Qnap Systems INC QufirewallQnap Qufirewall
Timeline
PublishedDec 19

Description

A command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote attackers who have gained administrator access to execute arbitrary commands. We have already fixed the vulnerability in the following versions: QuFirewall 2.3.3 ( 2023/03/27 ) and later and later

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:HExploitability: 1.2 | Impact: 5.9

Affected Packages2 packages

▶CVEListV5qnap_systems_inc/qufirewall2.3.x — 2.3.3 ( 2023/03/27 )
▶NVDqnap/qufirewall< 2.3.3

🔴Vulnerability Details

2
CVEList
QuFirewall↗2024-12-19
▶
GHSA
GHSA-7q2m-5cgc-3v5r: A command injection vulnerability has been reported to affect several QNAP operating system versions↗2024-12-19
▶
CVE-2023-23356 — Command Injection | cvebase