Read the docs
TI-2023-09215 Aliases CVE-2023-23369GHSA-5p75-fm4f-6c3v

Command injection in QNAP Multimedia Console

Priority MEDIUM 58CWE-77Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-77.

Summary

An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow users to execute commands via a network. We have already fixed the vulnerability in the following versions: Multimedia Console 2.1.2 ( 2023/05/04 ) and later Multimedia Console 1.4.8 ( 2023/05/05 ) and later QTS 5.1.0.2399 build 20230515 and later QTS 4.3.6.2441 build 20230621 and later QTS 4.3.4.2451 build 20230621 and later QTS 4.3.3.2420 build 20230621 and later QTS 4.2.6 build 20230621 and later Media Streaming add-on 500.1.1.2 ( 2023/06/12 ) and later Media Streaming add-on 500.0.0.11 ( 2023/06/16 ) and later

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.1415 96th percentileScored 2026-11-07
Fix Fixed Multimedia Console (QNAP Systems Inc.): 2.1.2 ( 2023/05/04 ), 1.4.8 ( 2023/05/05 )QTS (QNAP Systems Inc.): 5.1.0.2399 build 20230515, 4.3.6.2441 build 20230621, 4.3.4.2451 build 20230621 +2+1 more product

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
QNAPMultimedia Console2.1.x to before 2.1.2 ( 2023/05/04 ); 1.4.x to before 1.4.8 ( 2023/05/05 )2.1.2 ( 2023/05/04 ), 1.4.8 ( 2023/05/05 )Patch availableCNA
QNAPQTS5.1.x to before 5.1.0.2399 build 20230515; 4.3.6 to before 4.3.6.2441 build 20230621; 4.3.4 to before 4.3.4.2451 build 20230621; 4.3.3 to before 4.3.3.2420 build 20230621; 4.2.x to before 4.2.6 build 202306215.1.0.2399 build 20230515, 4.3.6.2441 build 20230621, 4.3.4.2451 build 20230621, 4.3.3.2420 build 20230621, 4.2.6 build 20230621Patch availableCNA
QNAPMedia Streaming add-on500.1.x to before 500.1.1.2 ( 2023/06/12 ); 500.0.x to before 500.0.0.11 ( 2023/06/16 )500.1.1.2 ( 2023/06/12 ), 500.0.0.11 ( 2023/06/16 )Patch availableCNA
  • Multimedia Console VendorQNAP Affected 2.1.x to before 2.1.2 ( 2023/05/04 ); 1.4.x to before 1.4.8 ( 2023/05/05 ) Fixed in 2.1.2 ( 2023/05/04 ), 1.4.8 ( 2023/05/05 ) Patch available CNA
  • QTS VendorQNAP Affected 5.1.x to before 5.1.0.2399 build 20230515; 4.3.6 to before 4.3.6.2441 build 20230621; 4.3.4 to before 4.3.4.2451 build 20230621; 4.3.3 to before 4.3.3.2420 build 20230621; 4.2.x to before 4.2.6 build 20230621 Fixed in 5.1.0.2399 build 20230515, 4.3.6.2441 build 20230621, 4.3.4.2451 build 20230621, 4.3.3.2420 build 20230621, 4.2.6 build 20230621 Patch available CNA
  • Media Streaming add-on VendorQNAP Affected 500.1.x to before 500.1.1.2 ( 2023/06/12 ); 500.0.x to before 500.0.0.11 ( 2023/06/16 ) Fixed in 500.1.1.2 ( 2023/06/12 ), 500.0.0.11 ( 2023/06/16 ) Patch available CNA

CPE configurations NVD · 91

CPEVersionsRoleVendor
cpe:2.3:o:qnap:qts:5.1.0.2348:build_20230325:*:*:*:*:*:*5.1.0.2348 build_20230325VulnerableQNAP
cpe:2.3:o:qnap:qts:4.3.6.0895:build_20190328:*:*:*:*:*:*4.3.6.0895 build_20190328VulnerableQNAP
cpe:2.3:o:qnap:qts:4.3.6.0907:build_20190409:*:*:*:*:*:*4.3.6.0907 build_20190409VulnerableQNAP
cpe:2.3:o:qnap:qts:4.3.6.0923:build_20190425:*:*:*:*:*:*4.3.6.0923 build_20190425VulnerableQNAP
cpe:2.3:o:qnap:qts:4.3.6.0944:build_20190516:*:*:*:*:*:*4.3.6.0944 build_20190516VulnerableQNAP
cpe:2.3:o:qnap:qts:4.3.6.0959:build_20190531:*:*:*:*:*:*4.3.6.0959 build_20190531VulnerableQNAP
cpe:2.3:o:qnap:qts:4.3.6.0979:build_20190620:*:*:*:*:*:*4.3.6.0979 build_20190620VulnerableQNAP
cpe:2.3:o:qnap:qts:4.3.6.0993:build_20190704:*:*:*:*:*:*4.3.6.0993 build_20190704VulnerableQNAP
cpe:2.3:o:qnap:qts:4.3.6.1013:build_20190724:*:*:*:*:*:*4.3.6.1013 build_20190724VulnerableQNAP
cpe:2.3:o:qnap:qts:4.3.6.1033:build_20190813:*:*:*:*:*:*4.3.6.1033 build_20190813VulnerableQNAP
  • cpe:2.3:o:qnap:qts:5.1.0.2348:build_20230325:*:*:*:*:*:* Versions 5.1.0.2348 build_20230325 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.6.0895:build_20190328:*:*:*:*:*:* Versions 4.3.6.0895 build_20190328 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.6.0907:build_20190409:*:*:*:*:*:* Versions 4.3.6.0907 build_20190409 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.6.0923:build_20190425:*:*:*:*:*:* Versions 4.3.6.0923 build_20190425 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.6.0944:build_20190516:*:*:*:*:*:* Versions 4.3.6.0944 build_20190516 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.6.0959:build_20190531:*:*:*:*:*:* Versions 4.3.6.0959 build_20190531 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.6.0979:build_20190620:*:*:*:*:*:* Versions 4.3.6.0979 build_20190620 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.6.0993:build_20190704:*:*:*:*:*:* Versions 4.3.6.0993 build_20190704 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.6.1013:build_20190724:*:*:*:*:*:* Versions 4.3.6.1013 build_20190724 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.6.1033:build_20190813:*:*:*:*:*:* Versions 4.3.6.1033 build_20190813 Vulnerable ·QNAP
Show 81 more CPE
CPEVersionsRoleVendor
cpe:2.3:o:qnap:qts:4.3.6.1070:build_20190919:*:*:*:*:*:*4.3.6.1070 build_20190919VulnerableQNAP
cpe:2.3:o:qnap:qts:4.3.6.1154:build_20191212:*:*:*:*:*:*4.3.6.1154 build_20191212VulnerableQNAP
cpe:2.3:o:qnap:qts:4.3.6.1218:build_20200214:*:*:*:*:*:*4.3.6.1218 build_20200214VulnerableQNAP
cpe:2.3:o:qnap:qts:4.3.6.1263:build_20200330:*:*:*:*:*:*4.3.6.1263 build_20200330VulnerableQNAP
cpe:2.3:o:qnap:qts:4.3.6.1286:build_20200422:*:*:*:*:*:*4.3.6.1286 build_20200422VulnerableQNAP
cpe:2.3:o:qnap:qts:4.3.6.1333:build_20200608:*:*:*:*:*:*4.3.6.1333 build_20200608VulnerableQNAP
cpe:2.3:o:qnap:qts:4.3.6.1411:build_20200825:*:*:*:*:*:*4.3.6.1411 build_20200825VulnerableQNAP
cpe:2.3:o:qnap:qts:4.3.6.1446:build_20200929:*:*:*:*:*:*4.3.6.1446 build_20200929VulnerableQNAP
cpe:2.3:o:qnap:qts:4.3.6.1620:build_20210322:*:*:*:*:*:*4.3.6.1620 build_20210322VulnerableQNAP
cpe:2.3:o:qnap:qts:4.3.6.1663:build_20210504:*:*:*:*:*:*4.3.6.1663 build_20210504VulnerableQNAP
cpe:2.3:o:qnap:qts:4.3.6.1711:build_20210621:*:*:*:*:*:*4.3.6.1711 build_20210621VulnerableQNAP
cpe:2.3:o:qnap:qts:4.3.6.1750:build_20210730:*:*:*:*:*:*4.3.6.1750 build_20210730VulnerableQNAP
cpe:2.3:o:qnap:qts:4.3.6.1831:build_20211019:*:*:*:*:*:*4.3.6.1831 build_20211019VulnerableQNAP
cpe:2.3:o:qnap:qts:4.3.6.1907:build_20220103:*:*:*:*:*:*4.3.6.1907 build_20220103VulnerableQNAP
cpe:2.3:o:qnap:qts:4.3.6.1965:build_20220302:*:*:*:*:*:*4.3.6.1965 build_20220302VulnerableQNAP
cpe:2.3:o:qnap:qts:4.3.6.2050:build_20220526:*:*:*:*:*:*4.3.6.2050 build_20220526VulnerableQNAP
cpe:2.3:o:qnap:qts:4.3.6.2232:build_20221124:*:*:*:*:*:*4.3.6.2232 build_20221124VulnerableQNAP
cpe:2.3:o:qnap:qts:4.3.4.0899:build_20190322:*:*:*:*:*:*4.3.4.0899 build_20190322VulnerableQNAP
cpe:2.3:o:qnap:qts:4.3.4.1029:build_20190730:*:*:*:*:*:*4.3.4.1029 build_20190730VulnerableQNAP
cpe:2.3:o:qnap:qts:4.3.4.1082:build_20190921:*:*:*:*:*:*4.3.4.1082 build_20190921VulnerableQNAP
cpe:2.3:o:qnap:qts:4.3.4.1190:build_20200107:*:*:*:*:*:*4.3.4.1190 build_20200107VulnerableQNAP
cpe:2.3:o:qnap:qts:4.3.4.1282:build_20200408:*:*:*:*:*:*4.3.4.1282 build_20200408VulnerableQNAP
cpe:2.3:o:qnap:qts:4.3.4.1368:build_20200703:*:*:*:*:*:*4.3.4.1368 build_20200703VulnerableQNAP
cpe:2.3:o:qnap:qts:4.3.4.1417:build_20200821:*:*:*:*:*:*4.3.4.1417 build_20200821VulnerableQNAP
cpe:2.3:o:qnap:qts:4.3.4.1463:build_20201006:*:*:*:*:*:*4.3.4.1463 build_20201006VulnerableQNAP
cpe:2.3:o:qnap:qts:4.3.4.1632:build_20210324:*:*:*:*:*:*4.3.4.1632 build_20210324VulnerableQNAP
cpe:2.3:o:qnap:qts:4.3.4.1652:build_20210413:*:*:*:*:*:*4.3.4.1652 build_20210413VulnerableQNAP
cpe:2.3:o:qnap:qts:4.3.4.1976:build_20220303:*:*:*:*:*:*4.3.4.1976 build_20220303VulnerableQNAP
cpe:2.3:o:qnap:qts:4.3.4.2107:build_20220712:*:*:*:*:*:*4.3.4.2107 build_20220712VulnerableQNAP
cpe:2.3:o:qnap:qts:4.3.4.2242:build_20221124:*:*:*:*:*:*4.3.4.2242 build_20221124VulnerableQNAP
cpe:2.3:o:qnap:qts:4.3.3.0174:build_20170503:*:*:*:*:*:*4.3.3.0174 build_20170503VulnerableQNAP
cpe:2.3:o:qnap:qts:4.3.3.0868:build_20190322:*:*:*:*:*:*4.3.3.0868 build_20190322VulnerableQNAP
cpe:2.3:o:qnap:qts:4.3.3.0998:build_20190730:*:*:*:*:*:*4.3.3.0998 build_20190730VulnerableQNAP
cpe:2.3:o:qnap:qts:4.3.3.1051:build_20190921:*:*:*:*:*:*4.3.3.1051 build_20190921VulnerableQNAP
cpe:2.3:o:qnap:qts:4.3.3.1098:build_20191107:*:*:*:*:*:*4.3.3.1098 build_20191107VulnerableQNAP
cpe:2.3:o:qnap:qts:4.3.3.1161:build_20200109:*:*:*:*:*:*4.3.3.1161 build_20200109VulnerableQNAP
cpe:2.3:o:qnap:qts:4.3.3.1252:build_20200409:*:*:*:*:*:*4.3.3.1252 build_20200409VulnerableQNAP
cpe:2.3:o:qnap:qts:4.3.3.1315:build_20200611:*:*:*:*:*:*4.3.3.1315 build_20200611VulnerableQNAP
cpe:2.3:o:qnap:qts:4.3.3.1386:build_20200821:*:*:*:*:*:*4.3.3.1386 build_20200821VulnerableQNAP
cpe:2.3:o:qnap:qts:4.3.3.1432:build_20201006:*:*:*:*:*:*4.3.3.1432 build_20201006VulnerableQNAP
cpe:2.3:o:qnap:qts:4.3.3.1624:build_20210416:*:*:*:*:*:*4.3.3.1624 build_20210416VulnerableQNAP
cpe:2.3:o:qnap:qts:4.3.3.1677:build_20210608:*:*:*:*:*:*4.3.3.1677 build_20210608VulnerableQNAP
cpe:2.3:o:qnap:qts:4.3.3.1693:build_20210624:*:*:*:*:*:*4.3.3.1693 build_20210624VulnerableQNAP
cpe:2.3:o:qnap:qts:4.3.3.1799:build_20211008:*:*:*:*:*:*4.3.3.1799 build_20211008VulnerableQNAP
cpe:2.3:o:qnap:qts:4.3.3.1864:build_20211212:*:*:*:*:*:*4.3.3.1864 build_20211212VulnerableQNAP
cpe:2.3:o:qnap:qts:4.3.3.1945:build_20220303:*:*:*:*:*:*4.3.3.1945 build_20220303VulnerableQNAP
cpe:2.3:o:qnap:qts:4.3.3.2057:build_20220623:*:*:*:*:*:*4.3.3.2057 build_20220623VulnerableQNAP
cpe:2.3:o:qnap:qts:4.3.3.2211:build_20221124:*:*:*:*:*:*4.3.3.2211 build_20221124VulnerableQNAP
cpe:2.3:o:qnap:qts:4.2.6:build_20170517:*:*:*:*:*:*4.2.6 build_20170517VulnerableQNAP
cpe:2.3:o:qnap:qts:4.2.6:build_20190322:*:*:*:*:*:*4.2.6 build_20190322VulnerableQNAP
cpe:2.3:o:qnap:qts:4.2.6:build_20190730:*:*:*:*:*:*4.2.6 build_20190730VulnerableQNAP
cpe:2.3:o:qnap:qts:4.2.6:build_20190921:*:*:*:*:*:*4.2.6 build_20190921VulnerableQNAP
cpe:2.3:o:qnap:qts:4.2.6:build_20191107:*:*:*:*:*:*4.2.6 build_20191107VulnerableQNAP
cpe:2.3:o:qnap:qts:4.2.6:build_20200109:*:*:*:*:*:*4.2.6 build_20200109VulnerableQNAP
cpe:2.3:o:qnap:qts:4.2.6:build_20200421:*:*:*:*:*:*4.2.6 build_20200421VulnerableQNAP
cpe:2.3:o:qnap:qts:4.2.6:build_20200611:*:*:*:*:*:*4.2.6 build_20200611VulnerableQNAP
cpe:2.3:o:qnap:qts:4.2.6:build_20200821:*:*:*:*:*:*4.2.6 build_20200821VulnerableQNAP
cpe:2.3:o:qnap:qts:4.2.6:build_20210327:*:*:*:*:*:*4.2.6 build_20210327VulnerableQNAP
cpe:2.3:o:qnap:qts:4.2.6:build_20211215:*:*:*:*:*:*4.2.6 build_20211215VulnerableQNAP
cpe:2.3:o:qnap:qts:4.2.6:build_20220304:*:*:*:*:*:*4.2.6 build_20220304VulnerableQNAP
cpe:2.3:o:qnap:qts:4.2.6:build_20220623:*:*:*:*:*:*4.2.6 build_20220623VulnerableQNAP
cpe:2.3:o:qnap:qts:4.2.6:build_20221028:*:*:*:*:*:*4.2.6 build_20221028VulnerableQNAP
cpe:2.3:a:qnap:multimedia_console:2.1.0:*:*:*:*:*:*:*2.1.0VulnerableQNAP
cpe:2.3:a:qnap:multimedia_console:2.1.1:*:*:*:*:*:*:*2.1.1VulnerableQNAP
cpe:2.3:a:qnap:multimedia_console:1.4.3:*:*:*:*:*:*:*1.4.3VulnerableQNAP
cpe:2.3:a:qnap:multimedia_console:1.4.4:*:*:*:*:*:*:*1.4.4VulnerableQNAP
cpe:2.3:a:qnap:multimedia_console:1.4.5:*:*:*:*:*:*:*1.4.5VulnerableQNAP
cpe:2.3:a:qnap:multimedia_console:1.4.6:*:*:*:*:*:*:*1.4.6VulnerableQNAP
cpe:2.3:a:qnap:multimedia_console:1.4.7:*:*:*:*:*:*:*1.4.7VulnerableQNAP
cpe:2.3:a:qnap:media_streaming_add-on:500.1.1.0:*:*:*:*:*:*:*500.1.1.0VulnerableQNAP
cpe:2.3:a:qnap:media_streaming_add-on:500.1.1.1:*:*:*:*:*:*:*500.1.1.1VulnerableQNAP
cpe:2.3:a:qnap:media_streaming_add-on:500.0.0.0:*:*:*:*:*:*:*500.0.0.0VulnerableQNAP
cpe:2.3:a:qnap:media_streaming_add-on:500.0.0.1:*:*:*:*:*:*:*500.0.0.1VulnerableQNAP
cpe:2.3:a:qnap:media_streaming_add-on:500.0.0.3:*:*:*:*:*:*:*500.0.0.3VulnerableQNAP
cpe:2.3:a:qnap:media_streaming_add-on:500.0.0.4:*:*:*:*:*:*:*500.0.0.4VulnerableQNAP
cpe:2.3:a:qnap:media_streaming_add-on:500.0.0.5:*:*:*:*:*:*:*500.0.0.5VulnerableQNAP
cpe:2.3:a:qnap:media_streaming_add-on:500.0.0.6:*:*:*:*:*:*:*500.0.0.6VulnerableQNAP
cpe:2.3:a:qnap:media_streaming_add-on:500.0.0.7:*:*:*:*:*:*:*500.0.0.7VulnerableQNAP
cpe:2.3:a:qnap:media_streaming_add-on:500.0.0.8:*:*:*:*:*:*:*500.0.0.8VulnerableQNAP
cpe:2.3:a:qnap:media_streaming_add-on:500.0.0.9:*:*:*:*:*:*:*500.0.0.9VulnerableQNAP
cpe:2.3:a:qnap:media_streaming_add-on:500.0.0.10:*:*:*:*:*:*:*500.0.0.10VulnerableQNAP
  • cpe:2.3:o:qnap:qts:4.3.6.1070:build_20190919:*:*:*:*:*:* Versions 4.3.6.1070 build_20190919 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.6.1154:build_20191212:*:*:*:*:*:* Versions 4.3.6.1154 build_20191212 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.6.1218:build_20200214:*:*:*:*:*:* Versions 4.3.6.1218 build_20200214 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.6.1263:build_20200330:*:*:*:*:*:* Versions 4.3.6.1263 build_20200330 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.6.1286:build_20200422:*:*:*:*:*:* Versions 4.3.6.1286 build_20200422 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.6.1333:build_20200608:*:*:*:*:*:* Versions 4.3.6.1333 build_20200608 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.6.1411:build_20200825:*:*:*:*:*:* Versions 4.3.6.1411 build_20200825 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.6.1446:build_20200929:*:*:*:*:*:* Versions 4.3.6.1446 build_20200929 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.6.1620:build_20210322:*:*:*:*:*:* Versions 4.3.6.1620 build_20210322 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.6.1663:build_20210504:*:*:*:*:*:* Versions 4.3.6.1663 build_20210504 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.6.1711:build_20210621:*:*:*:*:*:* Versions 4.3.6.1711 build_20210621 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.6.1750:build_20210730:*:*:*:*:*:* Versions 4.3.6.1750 build_20210730 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.6.1831:build_20211019:*:*:*:*:*:* Versions 4.3.6.1831 build_20211019 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.6.1907:build_20220103:*:*:*:*:*:* Versions 4.3.6.1907 build_20220103 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.6.1965:build_20220302:*:*:*:*:*:* Versions 4.3.6.1965 build_20220302 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.6.2050:build_20220526:*:*:*:*:*:* Versions 4.3.6.2050 build_20220526 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.6.2232:build_20221124:*:*:*:*:*:* Versions 4.3.6.2232 build_20221124 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.4.0899:build_20190322:*:*:*:*:*:* Versions 4.3.4.0899 build_20190322 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.4.1029:build_20190730:*:*:*:*:*:* Versions 4.3.4.1029 build_20190730 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.4.1082:build_20190921:*:*:*:*:*:* Versions 4.3.4.1082 build_20190921 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.4.1190:build_20200107:*:*:*:*:*:* Versions 4.3.4.1190 build_20200107 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.4.1282:build_20200408:*:*:*:*:*:* Versions 4.3.4.1282 build_20200408 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.4.1368:build_20200703:*:*:*:*:*:* Versions 4.3.4.1368 build_20200703 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.4.1417:build_20200821:*:*:*:*:*:* Versions 4.3.4.1417 build_20200821 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.4.1463:build_20201006:*:*:*:*:*:* Versions 4.3.4.1463 build_20201006 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.4.1632:build_20210324:*:*:*:*:*:* Versions 4.3.4.1632 build_20210324 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.4.1652:build_20210413:*:*:*:*:*:* Versions 4.3.4.1652 build_20210413 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.4.1976:build_20220303:*:*:*:*:*:* Versions 4.3.4.1976 build_20220303 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.4.2107:build_20220712:*:*:*:*:*:* Versions 4.3.4.2107 build_20220712 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.4.2242:build_20221124:*:*:*:*:*:* Versions 4.3.4.2242 build_20221124 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.3.0174:build_20170503:*:*:*:*:*:* Versions 4.3.3.0174 build_20170503 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.3.0868:build_20190322:*:*:*:*:*:* Versions 4.3.3.0868 build_20190322 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.3.0998:build_20190730:*:*:*:*:*:* Versions 4.3.3.0998 build_20190730 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.3.1051:build_20190921:*:*:*:*:*:* Versions 4.3.3.1051 build_20190921 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.3.1098:build_20191107:*:*:*:*:*:* Versions 4.3.3.1098 build_20191107 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.3.1161:build_20200109:*:*:*:*:*:* Versions 4.3.3.1161 build_20200109 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.3.1252:build_20200409:*:*:*:*:*:* Versions 4.3.3.1252 build_20200409 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.3.1315:build_20200611:*:*:*:*:*:* Versions 4.3.3.1315 build_20200611 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.3.1386:build_20200821:*:*:*:*:*:* Versions 4.3.3.1386 build_20200821 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.3.1432:build_20201006:*:*:*:*:*:* Versions 4.3.3.1432 build_20201006 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.3.1624:build_20210416:*:*:*:*:*:* Versions 4.3.3.1624 build_20210416 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.3.1677:build_20210608:*:*:*:*:*:* Versions 4.3.3.1677 build_20210608 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.3.1693:build_20210624:*:*:*:*:*:* Versions 4.3.3.1693 build_20210624 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.3.1799:build_20211008:*:*:*:*:*:* Versions 4.3.3.1799 build_20211008 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.3.1864:build_20211212:*:*:*:*:*:* Versions 4.3.3.1864 build_20211212 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.3.1945:build_20220303:*:*:*:*:*:* Versions 4.3.3.1945 build_20220303 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.3.2057:build_20220623:*:*:*:*:*:* Versions 4.3.3.2057 build_20220623 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.3.2211:build_20221124:*:*:*:*:*:* Versions 4.3.3.2211 build_20221124 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.2.6:build_20170517:*:*:*:*:*:* Versions 4.2.6 build_20170517 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.2.6:build_20190322:*:*:*:*:*:* Versions 4.2.6 build_20190322 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.2.6:build_20190730:*:*:*:*:*:* Versions 4.2.6 build_20190730 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.2.6:build_20190921:*:*:*:*:*:* Versions 4.2.6 build_20190921 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.2.6:build_20191107:*:*:*:*:*:* Versions 4.2.6 build_20191107 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.2.6:build_20200109:*:*:*:*:*:* Versions 4.2.6 build_20200109 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.2.6:build_20200421:*:*:*:*:*:* Versions 4.2.6 build_20200421 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.2.6:build_20200611:*:*:*:*:*:* Versions 4.2.6 build_20200611 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.2.6:build_20200821:*:*:*:*:*:* Versions 4.2.6 build_20200821 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.2.6:build_20210327:*:*:*:*:*:* Versions 4.2.6 build_20210327 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.2.6:build_20211215:*:*:*:*:*:* Versions 4.2.6 build_20211215 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.2.6:build_20220304:*:*:*:*:*:* Versions 4.2.6 build_20220304 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.2.6:build_20220623:*:*:*:*:*:* Versions 4.2.6 build_20220623 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.2.6:build_20221028:*:*:*:*:*:* Versions 4.2.6 build_20221028 Vulnerable ·QNAP
  • cpe:2.3:a:qnap:multimedia_console:2.1.0:*:*:*:*:*:*:* Versions 2.1.0 Vulnerable ·QNAP
  • cpe:2.3:a:qnap:multimedia_console:2.1.1:*:*:*:*:*:*:* Versions 2.1.1 Vulnerable ·QNAP
  • cpe:2.3:a:qnap:multimedia_console:1.4.3:*:*:*:*:*:*:* Versions 1.4.3 Vulnerable ·QNAP
  • cpe:2.3:a:qnap:multimedia_console:1.4.4:*:*:*:*:*:*:* Versions 1.4.4 Vulnerable ·QNAP
  • cpe:2.3:a:qnap:multimedia_console:1.4.5:*:*:*:*:*:*:* Versions 1.4.5 Vulnerable ·QNAP
  • cpe:2.3:a:qnap:multimedia_console:1.4.6:*:*:*:*:*:*:* Versions 1.4.6 Vulnerable ·QNAP
  • cpe:2.3:a:qnap:multimedia_console:1.4.7:*:*:*:*:*:*:* Versions 1.4.7 Vulnerable ·QNAP
  • cpe:2.3:a:qnap:media_streaming_add-on:500.1.1.0:*:*:*:*:*:*:* Versions 500.1.1.0 Vulnerable ·QNAP
  • cpe:2.3:a:qnap:media_streaming_add-on:500.1.1.1:*:*:*:*:*:*:* Versions 500.1.1.1 Vulnerable ·QNAP
  • cpe:2.3:a:qnap:media_streaming_add-on:500.0.0.0:*:*:*:*:*:*:* Versions 500.0.0.0 Vulnerable ·QNAP
  • cpe:2.3:a:qnap:media_streaming_add-on:500.0.0.1:*:*:*:*:*:*:* Versions 500.0.0.1 Vulnerable ·QNAP
  • cpe:2.3:a:qnap:media_streaming_add-on:500.0.0.3:*:*:*:*:*:*:* Versions 500.0.0.3 Vulnerable ·QNAP
  • cpe:2.3:a:qnap:media_streaming_add-on:500.0.0.4:*:*:*:*:*:*:* Versions 500.0.0.4 Vulnerable ·QNAP
  • cpe:2.3:a:qnap:media_streaming_add-on:500.0.0.5:*:*:*:*:*:*:* Versions 500.0.0.5 Vulnerable ·QNAP
  • cpe:2.3:a:qnap:media_streaming_add-on:500.0.0.6:*:*:*:*:*:*:* Versions 500.0.0.6 Vulnerable ·QNAP
  • cpe:2.3:a:qnap:media_streaming_add-on:500.0.0.7:*:*:*:*:*:*:* Versions 500.0.0.7 Vulnerable ·QNAP
  • cpe:2.3:a:qnap:media_streaming_add-on:500.0.0.8:*:*:*:*:*:*:* Versions 500.0.0.8 Vulnerable ·QNAP
  • cpe:2.3:a:qnap:media_streaming_add-on:500.0.0.9:*:*:*:*:*:*:* Versions 500.0.0.9 Vulnerable ·QNAP
  • cpe:2.3:a:qnap:media_streaming_add-on:500.0.0.10:*:*:*:*:*:*:* Versions 500.0.0.10 Vulnerable ·QNAP

Remediation

  • Fix · CNA Multimedia Console (QNAP Systems Inc.) Fixed in 2.1.2 ( 2023/05/04 ), 1.4.8 ( 2023/05/05 )
  • Fix · CNA QTS (QNAP Systems Inc.) Fixed in 5.1.0.2399 build 20230515, 4.3.6.2441 build 20230621, 4.3.4.2451 build 20230621, 4.3.3.2420 build 20230621, 4.2.6 build 20230621
  • Fix · CNA Media Streaming add-on (QNAP Systems Inc.) Fixed in 500.1.1.2 ( 2023/06/12 ), 500.0.0.11 ( 2023/06/16 )

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-23369
  2. 2026-10-03 Alias added: GHSA-5p75-fm4f-6c3v

References

Advisory 1

  • TI-2017-05276 OS command injection in QNAP Media Streaming Add-On CVSS 3.0CRITICAL 9.8
  • TI-2020-18515 SQL Injection Vulnerability in Multimedia Console and the Media Streaming Add-On CVSS 3.1CRITICAL 9.8
  • TI-2023-25540 Information disclosure in QNAP Media Streaming add-on CVSS 3.1CRITICAL 9.8
  • TI-2021-13401 Command Injection Vulnerability in Media Streaming Add-on CVSS 3.1HIGH 8.7
  • TI-2017-05277 QNAP NAS application Media Streaming add-on version 421.1.0.2, 430.1.2.0, and earlier does not utilize CSRF protections. CVSS 3.0HIGH 8.8
  • TI-2024-33828 Authorization bypass in QNAP Media Streaming add-on CVSS 4.0MEDIUM 6.9
See all 12 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences