CVE-2023-34975

published 2023-10-13

CVE-2023-34975: An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow…

Priority P2 60 high 8.8 CVSS 3.1

AV N AC L PR L UI N S U C H I H A H

An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated administrators to execute commands via a network.
QuTScloud is not affected.

We have already fixed the vulnerability in the following versions:
QuTS hero h4.5.4.2626 build 20231225 and later
QTS 4.5.4.2627 build 20231225 and later

Affected

3 ranges

Vendor	Product	Version range	Fixed in
qnap	video_station	< 5.7.0	5.7.0
qnap_systems_inc	qts	>= 4.5.x < 4.5.4.2627 build 20231225	4.5.4.2627 build 20231225
qnap_systems_inc	quts_hero	>= h4.5.x < h4.5.4.2626 build 20231225	h4.5.4.2626 build 20231225

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-78 CWE-89