CVE Feed

    Dashboard / CVE / CVE-2023-23355

    CVE-2023-23355

    An OS command injection vulnerability has been reported to affect QNAP operating systems. If exploited, the vulnerability possibly allows remote authenticated administrators to execute commands via unspecified vectors. QES is not affected. We have already fixed the vulnerability in the following versions: QTS 5.0.1.2346 build 20230322 and later QTS 4.5.4.2374 build 20230416 and later QuTS hero h5.0.1.2348 build 20230324 and later QuTS hero h4.5.4.2374 build 20230417 and later QuTScloud c5.0.1.2374 and later

    Published:Mar 29, 2023
    Last Modified:Feb 12, 2025
    EPS:Mar 29, 2023
    EPSS Score:0.0033
    CVSS Score:6.6

    Affected Products

    Vendor
    Qnap
    Product
    Qts
    Vendor
    Qnap
    Product
    Quts Hero
    Vendor
    Qnap
    Product
    Qutscloud
    Vendor
    Qnap
    Product
    Qvp-21a
    Vendor
    Qnap
    Product
    Qvp-21a Firmware
    Vendor
    Qnap
    Product
    Qvp-41a
    Vendor
    Qnap
    Product
    Qvp-41a Firmware
    Vendor
    Qnap
    Product
    Qvp-41b
    Vendor
    Qnap
    Product
    Qvp-41b Firmware
    Vendor
    Qnap
    Product
    Qvp-63a
    Vendor
    Qnap
    Product
    Qvp-63a Firmware
    Vendor
    Qnap
    Product
    Qvp-63b
    Vendor
    Qnap
    Product
    Qvp-63b Firmware
    Vendor
    Qnap
    Product
    Qvp-85a
    Vendor
    Qnap
    Product
    Qvp-85a Firmware
    Vendor
    Qnap
    Product
    Qvp-85b
    Vendor
    Qnap
    Product
    Qvp-85b Firmware
    Vendor
    Qnap
    Product
    Qvr

    Exploits

    No exploit reference

    Related CVEs

    CVE-2026-24719 (CVSS 6.1) — A command injection vulnerability has been reported to affect several QNAP operating system versions. If a rem…
    CVE-2026-24717 (CVSS 1.2) — A path traversal vulnerability has been reported to affect several QNAP operating system versions. If a remote…
    CVE-2026-24716 (CVSS 1.2) — A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. I…
    CVE-2026-22893 (CVSS 8.6) — A command injection vulnerability has been reported to affect several QNAP operating system versions. If a rem…
    CVE-2025-66281 (CVSS 6.9) — A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. T…
    CVE-2025-66280 (CVSS 5.1) — An integer overflow or wraparound vulnerability has been reported to affect several QNAP operating system vers…
    CVE-2025-66279 (CVSS 8.6) — A command injection vulnerability has been reported to affect several QNAP operating system versions. If a rem…
    CVE-2025-66273 (CVSS 8.6) — A command injection vulnerability has been reported to affect several QNAP operating system versions. If a rem…
    CVE-2025-66276 (CVSS 9.2) — QuTS hero is not affected. We have already fixed the vulnerability in the following version: QTS 5.2.7.3256 b…
    CVE-2025-62858 (CVSS 5.1) — A buffer overflow vulnerability has been reported to affect several QNAP operating system versions. If a remot…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High