CVE-2023-23363

published 2023-09-22

CVE-2023-23363: A buffer copy without checking size of input vulnerability has been reported to affect QNAP operating system. If exploited, the vulnerability possibly allows…

Priority P3 57 critical 9.8 CVSS 3.1

AV N AC L PR N UI N S U C H I H A H

A buffer copy without checking size of input vulnerability has been reported to affect QNAP operating system. If exploited, the vulnerability possibly allows remote users to execute code via unspecified vectors.

We have already fixed the vulnerability in the following versions:
QTS 4.3.6.2441 build 20230621 and later
QTS 4.3.3.2420 build 20230621 and later
QTS 4.2.6 build 20230621 and later
QTS 4.3.4.2451 build 20230621 and later

Affected

7 ranges

Vendor	Product	Version range	Fixed in
qnap	qts	>= 4.3.3 < 4.3.3.2420	4.3.3.2420
qnap	qts	>= 4.3.4 < 4.3.4.245	4.3.4.245
qnap	qts	>= 4.3.6 < 4.3.6.2441	4.3.6.2441
qnap_systems_inc	qts	>= 4.2.* < 4.2.6 build 20230621	4.2.6 build 20230621
qnap_systems_inc	qts	>= 4.3.* < 4.3.6.2441 build 20230621	4.3.6.2441 build 20230621
qnap_systems_inc	qts	>= 4.3.* < 4.3.3.2420 build 20230621	4.3.3.2420 build 20230621
qnap_systems_inc	qts	>= 4.3.* < 4.3.4.2451 build 20230621	4.3.4.2451 build 20230621

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-120