CVE-2023-47562 — Command Injection in Systems INC Photo Station

CWE-77 — Command InjectionCWE-78 — OS Command Injection3 documents3 sources
Severity
8.8HIGHNVD
CNA7.4
EPSS
0.4%
top 41.65%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Qnap Systems INC Photo StationQnap Photo Station
Timeline
PublishedFeb 2

Description

An OS command injection vulnerability has been reported to affect Photo Station. If exploited, the vulnerability could allow authenticated users to execute commands via a network. We have already fixed the vulnerability in the following version: Photo Station 6.4.2 ( 2023/12/15 ) and later

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 2.8 | Impact: 5.9

Affected Packages2 packages

▶NVDqnap/photo_station6.4.0 — 6.4.2
▶CVEListV5qnap_systems_inc/photo_station6.4.x — 6.4.2 ( 2023/12/15 )

🔴Vulnerability Details

2
CVEList
Photo Station↗2024-02-02
▶
GHSA
GHSA-36w5-pmj5-pph2: An OS command injection vulnerability has been reported to affect Photo Station↗2024-02-02
▶
CVE-2023-47562 — Command Injection | cvebase