CVE-2023-39300 (GCVE-0-2023-39300)
Vulnerability from cvelistv5 – Published: 2024-09-06 16:27 – Updated: 2024-09-06 17:44
VLAI
EPSS
VEX
Title
QTS
Summary
An OS command injection vulnerability has been reported to affect legacy QTS. If exploited, the vulnerability could allow authenticated administrators to execute commands via a network.
We have already fixed the vulnerability in the following versions:
QTS 4.3.6.2805 build 20240619 and later
QTS 4.3.4.2814 build 20240618 and later
QTS 4.3.3.2784 build 20240619 and later
QTS 4.2.6 build 20240618 and later
Severity
7.2 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-09-06 17:35 UTC
CWE
Assigner
References
1 reference
Impacted products
5 products
| Vendor | Product | Version | CPE status | |
|---|---|---|---|---|
| QNAP Systems Inc. | QTS |
Affected:
4.3.6 , < 4.3.6.2805 build 20240619
(custom)
Affected: 4.3.4 , < 4.3.4.2814 build 20240618 (custom) Affected: 4.3.3 , < 4.3.3.2784 build 20240619 (custom) Affected: 4.2.6 , < 4.2.6 build 20240618 (custom) |
guessed | |
| QNAP Systems Inc. | QTS |
Unaffected:
5.x
Unaffected: 4.5.x |
guessed | |
| QNAP Systems Inc. | QuTS hero |
Unaffected:
h5.x
Unaffected: h4.5.x |
guessed | |
| QNAP Systems Inc. | QuTScloud |
Unaffected:
c5.x
|
guessed | |
| qnap | qts |
Affected:
4.3.6 , < 4.3.6.2805_build_20240619
(custom)
Affected: 4.3.4 , < 4.3.4.2814_build_20240618 (custom) Affected: 4.3.3 , < 4.3.3.2784_build_20240619 (custom) Affected: 4.2.6 , < 4.2.6_build_20240618 (custom) cpe:2.3:o:qnap:qts:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:o:qnap:qts:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "qts",
"vendor": "qnap",
"versions": [
{
"lessThan": "4.3.6.2805_build_20240619",
"status": "affected",
"version": "4.3.6",
"versionType": "custom"
},
{
"lessThan": "4.3.4.2814_build_20240618",
"status": "affected",
"version": "4.3.4",
"versionType": "custom"
},
{
"lessThan": "4.3.3.2784_build_20240619",
"status": "affected",
"version": "4.3.3",
"versionType": "custom"
},
{
"lessThan": "4.2.6_build_20240618",
"status": "affected",
"version": "4.2.6",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-39300",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-09-06T17:35:15.918021Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-09-06T17:44:00.200Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "QTS",
"vendor": "QNAP Systems Inc.",
"versions": [
{
"lessThan": "4.3.6.2805 build 20240619",
"status": "affected",
"version": "4.3.6",
"versionType": "custom"
},
{
"lessThan": "4.3.4.2814 build 20240618",
"status": "affected",
"version": "4.3.4",
"versionType": "custom"
},
{
"lessThan": "4.3.3.2784 build 20240619",
"status": "affected",
"version": "4.3.3",
"versionType": "custom"
},
{
"lessThan": "4.2.6 build 20240618",
"status": "affected",
"version": "4.2.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "QTS",
"vendor": "QNAP Systems Inc.",
"versions": [
{
"status": "unaffected",
"version": "5.x"
},
{
"status": "unaffected",
"version": "4.5.x"
}
]
},
{
"defaultStatus": "unaffected",
"product": "QuTS hero",
"vendor": "QNAP Systems Inc.",
"versions": [
{
"status": "unaffected",
"version": "h5.x"
},
{
"status": "unaffected",
"version": "h4.5.x"
}
]
},
{
"defaultStatus": "unaffected",
"product": "QuTScloud",
"vendor": "QNAP Systems Inc.",
"versions": [
{
"status": "unaffected",
"version": "c5.x"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Arseniy Sharoglazov"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "An OS command injection vulnerability has been reported to affect legacy QTS. If exploited, the vulnerability could allow authenticated administrators to execute commands via a network.\u003cbr\u003e\u003cbr\u003eWe have already fixed the vulnerability in the following versions:\u003cbr\u003eQTS 4.3.6.2805 build 20240619 and later\u003cbr\u003eQTS 4.3.4.2814 build 20240618 and later\u003cbr\u003eQTS 4.3.3.2784 build 20240619 and later\u003cbr\u003eQTS 4.2.6 build 20240618 and later\u003cbr\u003e"
}
],
"value": "An OS command injection vulnerability has been reported to affect legacy QTS. If exploited, the vulnerability could allow authenticated administrators to execute commands via a network.\n\nWe have already fixed the vulnerability in the following versions:\nQTS 4.3.6.2805 build 20240619 and later\nQTS 4.3.4.2814 build 20240618 and later\nQTS 4.3.3.2784 build 20240619 and later\nQTS 4.2.6 build 20240618 and later"
}
],
"impacts": [
{
"capecId": "CAPEC-88",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-88"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "CWE-78",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-09-06T16:27:04.275Z",
"orgId": "2fd009eb-170a-4625-932b-17a53af1051f",
"shortName": "qnap"
},
"references": [
{
"url": "https://www.qnap.com/en/security-advisory/qsa-24-26"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "We have already fixed the vulnerability in the following versions:\u003cbr\u003eQTS 4.3.6.2805 build 20240619 and later\u003cbr\u003eQTS 4.3.4.2814 build 20240618 and later\u003cbr\u003eQTS 4.3.3.2784 build 20240619 and later\u003cbr\u003eQTS 4.2.6 build 20240618 and later\u003cbr\u003e"
}
],
"value": "We have already fixed the vulnerability in the following versions:\nQTS 4.3.6.2805 build 20240619 and later\nQTS 4.3.4.2814 build 20240618 and later\nQTS 4.3.3.2784 build 20240619 and later\nQTS 4.2.6 build 20240618 and later"
}
],
"source": {
"advisory": "QSA-24-26",
"discovery": "EXTERNAL"
},
"title": "QTS",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "2fd009eb-170a-4625-932b-17a53af1051f",
"assignerShortName": "qnap",
"cveId": "CVE-2023-39300",
"datePublished": "2024-09-06T16:27:04.275Z",
"dateReserved": "2023-07-27T06:46:01.477Z",
"dateUpdated": "2024-09-06T17:44:00.200Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1",
"vulnerability-lookup:meta": {
"epss": {
"cve": "CVE-2023-39300",
"date": "2026-09-21",
"epss": "0.01212",
"percentile": "0.66688"
},
"fkie_nvd": {
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:qnap:qts:4.3.6.0895:build_20190328:*:*:*:*:*:*",
"matchCriteriaId": "C39B0B5B-93CB-4106-AAA3-00E6E61DDC08",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:qnap:qts:4.3.6.0907:build_20190409:*:*:*:*:*:*",
"matchCriteriaId": "1C4725E3-30EE-44C6-9666-889EE2A24E39",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:qnap:qts:4.3.6.0923:build_20190425:*:*:*:*:*:*",
"matchCriteriaId": "4217A41D-B8E3-4E42-8583-96A284CA46D0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:qnap:qts:4.3.6.0944:build_20190516:*:*:*:*:*:*",
"matchCriteriaId": "2095D4D4-409D-486A-B389-08645DE2E0CA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:qnap:qts:4.3.6.0959:build_20190531:*:*:*:*:*:*",
"matchCriteriaId": "E49E2317-BBB3-4E52-958A-727E51EC93FD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:qnap:qts:4.3.6.0979:build_20190620:*:*:*:*:*:*",
"matchCriteriaId": "E0E448EC-BA27-4271-800A-D7C84958CBE2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:qnap:qts:4.3.6.0993:build_20190704:*:*:*:*:*:*",
"matchCriteriaId": "0CF83203-FC41-4EE8-8867-42E8A99C0E05",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:qnap:qts:4.3.6.1013:build_20190724:*:*:*:*:*:*",
"matchCriteriaId": "AED6D211-E440-430C-8DB2-AF4DC5B75199",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:qnap:qts:4.3.6.1033:build_20190813:*:*:*:*:*:*",
"matchCriteriaId": "FD0BC5AB-F6D3-4A57-B186-CA683796D879",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:qnap:qts:4.3.6.1070:build_20190919:*:*:*:*:*:*",
"matchCriteriaId": "1400CC6C-2C00-43A5-A39C-7FF7A45B4D1C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:qnap:qts:4.3.6.1154:build_20191212:*:*:*:*:*:*",
"matchCriteriaId": "E8F0065B-7CE5-4EFF-899A-100086D71B14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:qnap:qts:4.3.6.1218:build_20200214:*:*:*:*:*:*",
"matchCriteriaId": "63A88B37-B94A-4627-BF0A-69805499F16B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:qnap:qts:4.3.6.1263:build_20200330:*:*:*:*:*:*",
"matchCriteriaId": "F347765F-1C36-41AA-8414-56FEB66F45C5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:qnap:qts:4.3.6.1286:build_20200422:*:*:*:*:*:*",
"matchCriteriaId": "E22A7A54-3FBD-4FF5-842B-20CDEF56EF37",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:qnap:qts:4.3.6.1333:build_20200608:*:*:*:*:*:*",
"matchCriteriaId": "40551635-979F-4D0A-B8F2-F640073091E6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:qnap:qts:4.3.6.1411:build_20200825:*:*:*:*:*:*",
"matchCriteriaId": "2D56EDE7-E16F-4EE6-AD88-0901687F2DAB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:qnap:qts:4.3.6.1446:build_20200929:*:*:*:*:*:*",
"matchCriteriaId": "D3816896-A891-45AF-BE47-3D2857DAC541",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:qnap:qts:4.3.6.1620:build_20210322:*:*:*:*:*:*",
"matchCriteriaId": "5F01EA3A-CC9B-406E-8643-6054ABE9AD52",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:qnap:qts:4.3.6.1663:build_20210504:*:*:*:*:*:*",
"matchCriteriaId": "D8AA595A-36CA-490F-B6BD-9D896F58FF2A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:qnap:qts:4.3.6.1711:build_20210621:*:*:*:*:*:*",
"matchCriteriaId": "2214698A-09DB-40F5-ABDA-55CEB759ACFF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:qnap:qts:4.3.6.1750:build_20210730:*:*:*:*:*:*",
"matchCriteriaId": "232782BB-25D4-4BD1-AAF0-22530CE2C82B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:qnap:qts:4.3.6.1831:build_20211019:*:*:*:*:*:*",
"matchCriteriaId": "B754C198-F85C-401B-995B-D61A73057F5F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:qnap:qts:4.3.6.1907:build_20220103:*:*:*:*:*:*",
"matchCriteriaId": "61CAA378-3236-46B4-8A14-092EFF921073",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:qnap:qts:4.3.6.1965:build_20220302:*:*:*:*:*:*",
"matchCriteriaId": "63D954BB-F6C4-4C3A-9E71-F34E53B8E764",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:qnap:qts:4.3.6.2050:build_20220526:*:*:*:*:*:*",
"matchCriteriaId": "E252DEAA-10C0-4A7D-B66A-1C9ABFC042C5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:qnap:qts:4.3.6.2232:build_20221124:*:*:*:*:*:*",
"matchCriteriaId": "B8099233-501E-41E8-BBDA-0F5C6BDC0FDE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:qnap:qts:4.3.6.2441:build_20230621:*:*:*:*:*:*",
"matchCriteriaId": "E5E98E02-D677-4E31-A498-C18E64816F6C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:qnap:qts:4.3.6.2665:build_20240131:*:*:*:*:*:*",
"matchCriteriaId": "7C41F264-FD5E-481C-BF90-6EEA634E554C",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:qnap:qts:4.3.4.0899:build_20190322:*:*:*:*:*:*",
"matchCriteriaId": "971833DE-934A-4BB5-AA50-E424A3D4EE49",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:qnap:qts:4.3.4.1029:build_20190730:*:*:*:*:*:*",
"matchCriteriaId": "8CF7C63D-18EE-4297-980C-72111832DBA9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:qnap:qts:4.3.4.1082:build_20190921:*:*:*:*:*:*",
"matchCriteriaId": "ED6B6071-8D91-466D-80DB-1620CE9202D5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:qnap:qts:4.3.4.1190:build_20200107:*:*:*:*:*:*",
"matchCriteriaId": "71B9DEEF-D85C-46CE-B0D4-902397B8CD96",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:qnap:qts:4.3.4.1282:build_20200408:*:*:*:*:*:*",
"matchCriteriaId": "DB07475A-7C40-450F-85BE-D8A8F7434C0A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:qnap:qts:4.3.4.1368:build_20200703:*:*:*:*:*:*",
"matchCriteriaId": "D8A4458A-136F-483D-98D4-43568EC4FC0F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:qnap:qts:4.3.4.1417:build_20200821:*:*:*:*:*:*",
"matchCriteriaId": "D26CD586-13C5-4F77-9DC0-3565A3FF7F60",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:qnap:qts:4.3.4.1463:build_20201006:*:*:*:*:*:*",
"matchCriteriaId": "6390A450-25B5-41CC-9866-1AC81ECD0DC5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:qnap:qts:4.3.4.1632:build_20210324:*:*:*:*:*:*",
"matchCriteriaId": "DD5F45E0-8DE4-4DF0-AF65-DE8149E2B738",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:qnap:qts:4.3.4.1652:build_20210413:*:*:*:*:*:*",
"matchCriteriaId": "CE252780-1A93-4211-91E3-CE46B26EC2AA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:qnap:qts:4.3.4.1976:build_20220303:*:*:*:*:*:*",
"matchCriteriaId": "C2103CD3-4E85-4C08-A73C-EE5392682027",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:qnap:qts:4.3.4.2107:build_20220712:*:*:*:*:*:*",
"matchCriteriaId": "E21AE5D2-93C8-49AF-A88D-F8C561B76857",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:qnap:qts:4.3.4.2242:build_20221124:*:*:*:*:*:*",
"matchCriteriaId": "D7268137-D207-4294-9CD1-BA776AE9606E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:qnap:qts:4.3.4.2451:build_20230621:*:*:*:*:*:*",
"matchCriteriaId": "275EE698-6440-4980-92E3-52479EB08CE7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:qnap:qts:4.3.4.2675:build_20240131:*:*:*:*:*:*",
"matchCriteriaId": "F86DE576-C9BF-46C4-BFBF-67C34F173B97",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:qnap:qts:4.3.3.0174:build_20170503:*:*:*:*:*:*",
"matchCriteriaId": "3686F6D2-9F42-489A-B4FF-9CDF127BD2F4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:qnap:qts:4.3.3.0868:build_20190322:*:*:*:*:*:*",
"matchCriteriaId": "08C2B922-0B29-41FA-9FA7-5821713541E4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:qnap:qts:4.3.3.0998:build_20190730:*:*:*:*:*:*",
"matchCriteriaId": "32BFAA90-8807-4D5E-B150-0760F682C6D7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:qnap:qts:4.3.3.1051:build_20190921:*:*:*:*:*:*",
"matchCriteriaId": "5F26EEEF-EDCD-4E7F-8F66-FD44B6521663",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:qnap:qts:4.3.3.1098:build_20191107:*:*:*:*:*:*",
"matchCriteriaId": "81652269-F0DB-4350-8DC0-4CC203C1DF11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:qnap:qts:4.3.3.1161:build_20200109:*:*:*:*:*:*",
"matchCriteriaId": "B1DCFEFF-AB18-4B4E-9B99-9DBDC5AF49CB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:qnap:qts:4.3.3.1252:build_20200409:*:*:*:*:*:*",
"matchCriteriaId": "9951A1AF-4B46-4D9D-B6C5-2BCB15BD070C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:qnap:qts:4.3.3.1315:build_20200611:*:*:*:*:*:*",
"matchCriteriaId": "0AB586D1-CF9F-4C87-B604-6A9DB9657D76",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:qnap:qts:4.3.3.1386:build_20200821:*:*:*:*:*:*",
"matchCriteriaId": "6D3650DB-205C-4B13-BDFC-E56172DD4156",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:qnap:qts:4.3.3.1432:build_20201006:*:*:*:*:*:*",
"matchCriteriaId": "ECD41187-A0AF-41E8-A884-E605C6CF7DFE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:qnap:qts:4.3.3.1624:build_20210416:*:*:*:*:*:*",
"matchCriteriaId": "DC95BBCC-A0D8-42FB-880F-5155655519C3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:qnap:qts:4.3.3.1677:build_20210608:*:*:*:*:*:*",
"matchCriteriaId": "7D84B904-55E9-414A-9CBC-232EADD08E88",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:qnap:qts:4.3.3.1693:build_20210624:*:*:*:*:*:*",
"matchCriteriaId": "1FA8C7BD-C123-484A-8317-37AE1C68D110",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:qnap:qts:4.3.3.1799:build_20211008:*:*:*:*:*:*",
"matchCriteriaId": "C0BAF780-8DD3-4AC4-86CF-A2FD903EA171",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:qnap:qts:4.3.3.1864:build_20211212:*:*:*:*:*:*",
"matchCriteriaId": "F25FEB20-22E9-41B5-B310-21C95D29C604",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:qnap:qts:4.3.3.1945:build_20220303:*:*:*:*:*:*",
"matchCriteriaId": "82EE2EC6-F5EA-4E6A-B24A-C9D5925B4EA1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:qnap:qts:4.3.3.2057:build_20220623:*:*:*:*:*:*",
"matchCriteriaId": "2C735F47-4409-47E9-B616-31BADC64EB5E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:qnap:qts:4.3.3.2211:build_20221124:*:*:*:*:*:*",
"matchCriteriaId": "BEC5C7EC-0055-4D83-B700-6BB571139761",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:qnap:qts:4.3.3.2420:build_20230621:*:*:*:*:*:*",
"matchCriteriaId": "58ADDC0D-9550-4713-A068-A39D001F84FD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:qnap:qts:4.3.3.2644:build_20240131:*:*:*:*:*:*",
"matchCriteriaId": "62168CE8-D892-4291-B85B-EA171BBB9074",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:qnap:qts:4.2.6:build_20170517:*:*:*:*:*:*",
"matchCriteriaId": "8F523E9F-D101-4C29-A624-74E1F3F8CB7D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:qnap:qts:4.2.6:build_20190322:*:*:*:*:*:*",
"matchCriteriaId": "1388DBE0-F6BB-44AB-81AC-BFB4E70BE820",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:qnap:qts:4.2.6:build_20190730:*:*:*:*:*:*",
"matchCriteriaId": "CF3C4461-C1B6-43A1-BA5E-D6658EFD06EE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:qnap:qts:4.2.6:build_20190921:*:*:*:*:*:*",
"matchCriteriaId": "A1F11848-6FED-4D58-A177-36D280C0347C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:qnap:qts:4.2.6:build_20191107:*:*:*:*:*:*",
"matchCriteriaId": "F6259C86-FFDA-40E8-AF0C-33CC8C108DC9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:qnap:qts:4.2.6:build_20200109:*:*:*:*:*:*",
"matchCriteriaId": "9E01E157-BDF1-4B00-BA9B-6887C0C7DFF2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:qnap:qts:4.2.6:build_20200421:*:*:*:*:*:*",
"matchCriteriaId": "1D1E5368-9587-4E0A-BB65-D88069CA8490",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:qnap:qts:4.2.6:build_20200611:*:*:*:*:*:*",
"matchCriteriaId": "B63CE419-871C-4866-8AB1-4BB6461E1D74",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:qnap:qts:4.2.6:build_20200821:*:*:*:*:*:*",
"matchCriteriaId": "886A71D1-9615-47A5-B3C2-CBC6F02961A4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:qnap:qts:4.2.6:build_20210327:*:*:*:*:*:*",
"matchCriteriaId": "9B7A506C-1F53-4CEC-9828-9327352DE153",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:qnap:qts:4.2.6:build_20211215:*:*:*:*:*:*",
"matchCriteriaId": "060D81A5-599A-4329-99C8-D69725C65AF3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:qnap:qts:4.2.6:build_20220304:*:*:*:*:*:*",
"matchCriteriaId": "DB41EDDB-E185-4E3F-9497-3826A7955BBE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:qnap:qts:4.2.6:build_20220623:*:*:*:*:*:*",
"matchCriteriaId": "86830BEE-D24C-4618-9070-EA968D533096",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:qnap:qts:4.2.6:build_20221028:*:*:*:*:*:*",
"matchCriteriaId": "5FDF9A85-F956-4C2F-80FD-E5D899761A15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:qnap:qts:4.2.6:build_20230621:*:*:*:*:*:*",
"matchCriteriaId": "F80B7DEF-3EB6-4C48-B0A6-108211B34BFF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:qnap:qts:4.2.6:build_20240131:*:*:*:*:*:*",
"matchCriteriaId": "4467FB2F-9A18-4211-A251-C4FCDB18CAA5",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "An OS command injection vulnerability has been reported to affect legacy QTS. If exploited, the vulnerability could allow authenticated administrators to execute commands via a network.\n\nWe have already fixed the vulnerability in the following versions:\nQTS 4.3.6.2805 build 20240619 and later\nQTS 4.3.4.2814 build 20240618 and later\nQTS 4.3.3.2784 build 20240619 and later\nQTS 4.2.6 build 20240618 and later"
},
{
"lang": "es",
"value": "Se ha informado de una vulnerabilidad de inyecci\u00f3n de comandos del sistema operativo que afecta a la versi\u00f3n anterior de QTS. Si se explota, la vulnerabilidad podr\u00eda permitir que los administradores autenticados ejecuten comandos a trav\u00e9s de una red. Ya hemos corregido la vulnerabilidad en las siguientes versiones: QTS 4.3.6.2805, compilaci\u00f3n 20240619 y posteriores QTS 4.3.4.2814, compilaci\u00f3n 20240618 y posteriores QTS 4.3.3.2784, compilaci\u00f3n 20240619 y posteriores QTS 4.2.6, compilaci\u00f3n 20240618 y posteriores"
}
],
"id": "CVE-2023-39300",
"lastModified": "2024-09-24T16:42:02.873",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 1.2,
"impactScore": 5.9,
"source": "security@qnapsecurity.com.tw",
"type": "Secondary"
},
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 1.2,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2024-09-06T17:15:12.070",
"references": [
{
"source": "security@qnapsecurity.com.tw",
"tags": [
"Vendor Advisory"
],
"url": "https://www.qnap.com/en/security-advisory/qsa-24-26"
}
],
"sourceIdentifier": "security@qnapsecurity.com.tw",
"vulnStatus": "Analyzed",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-78"
}
],
"source": "security@qnapsecurity.com.tw",
"type": "Primary"
}
]
},
"nvd": {
"cve": {
"affected": [
{
"affectedData": [
{
"defaultStatus": "unaffected",
"product": "QTS",
"vendor": "QNAP Systems Inc.",
"versions": [
{
"lessThan": "4.3.6.2805 build 20240619",
"status": "affected",
"version": "4.3.6",
"versionType": "custom"
},
{
"lessThan": "4.3.4.2814 build 20240618",
"status": "affected",
"version": "4.3.4",
"versionType": "custom"
},
{
"lessThan": "4.3.3.2784 build 20240619",
"status": "affected",
"version": "4.3.3",
"versionType": "custom"
},
{
"lessThan": "4.2.6 build 20240618",
"status": "affected",
"version": "4.2.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "QTS",
"vendor": "QNAP Systems Inc.",
"versions": [
{
"status": "unaffected",
"version": "5.x"
},
{
"status": "unaffected",
"version": "4.5.x"
}
]
},
{
"defaultStatus": "unaffected",
"product": "QuTS hero",
"vendor": "QNAP Systems Inc.",
"versions": [
{
"status": "unaffected",
"version": "h5.x"
},
{
"status": "unaffected",
"version": "h4.5.x"
}
]
},
{
"defaultStatus": "unaffected",
"product": "QuTScloud",
"vendor": "QNAP Systems Inc.",
"versions": [
{
"status": "unaffected",
"version": "c5.x"
}
]
}
],
"source": "security@qnapsecurity.com.tw"
},
{
"affectedData": [
{
"cpes": [
"cpe:2.3:o:qnap:qts:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "qts",
"vendor": "qnap",
"versions": [
{
"lessThan": "4.3.6.2805_build_20240619",
"status": "affected",
"version": "4.3.6",
"versionType": "custom"
},
{
"lessThan": "4.3.4.2814_build_20240618",
"status": "affected",
"version": "4.3.4",
"versionType": "custom"
},
{
"lessThan": "4.3.3.2784_build_20240619",
"status": "affected",
"version": "4.3.3",
"versionType": "custom"
},
{
"lessThan": "4.2.6_build_20240618",
"status": "affected",
"version": "4.2.6",
"versionType": "custom"
}
]
}
],
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
}
],
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:qnap:qts:4.3.6.0895:build_20190328:*:*:*:*:*:*",
"matchCriteriaId": "C39B0B5B-93CB-4106-AAA3-00E6E61DDC08",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:qnap:qts:4.3.6.0907:build_20190409:*:*:*:*:*:*",
"matchCriteriaId": "1C4725E3-30EE-44C6-9666-889EE2A24E39",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:qnap:qts:4.3.6.0923:build_20190425:*:*:*:*:*:*",
"matchCriteriaId": "4217A41D-B8E3-4E42-8583-96A284CA46D0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:qnap:qts:4.3.6.0944:build_20190516:*:*:*:*:*:*",
"matchCriteriaId": "2095D4D4-409D-486A-B389-08645DE2E0CA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:qnap:qts:4.3.6.0959:build_20190531:*:*:*:*:*:*",
"matchCriteriaId": "E49E2317-BBB3-4E52-958A-727E51EC93FD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:qnap:qts:4.3.6.0979:build_20190620:*:*:*:*:*:*",
"matchCriteriaId": "E0E448EC-BA27-4271-800A-D7C84958CBE2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:qnap:qts:4.3.6.0993:build_20190704:*:*:*:*:*:*",
"matchCriteriaId": "0CF83203-FC41-4EE8-8867-42E8A99C0E05",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:qnap:qts:4.3.6.1013:build_20190724:*:*:*:*:*:*",
"matchCriteriaId": "AED6D211-E440-430C-8DB2-AF4DC5B75199",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:qnap:qts:4.3.6.1033:build_20190813:*:*:*:*:*:*",
"matchCriteriaId": "FD0BC5AB-F6D3-4A57-B186-CA683796D879",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:qnap:qts:4.3.6.1070:build_20190919:*:*:*:*:*:*",
"matchCriteriaId": "1400CC6C-2C00-43A5-A39C-7FF7A45B4D1C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:qnap:qts:4.3.6.1154:build_20191212:*:*:*:*:*:*",
"matchCriteriaId": "E8F0065B-7CE5-4EFF-899A-100086D71B14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:qnap:qts:4.3.6.1218:build_20200214:*:*:*:*:*:*",
"matchCriteriaId": "63A88B37-B94A-4627-BF0A-69805499F16B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:qnap:qts:4.3.6.1263:build_20200330:*:*:*:*:*:*",
"matchCriteriaId": "F347765F-1C36-41AA-8414-56FEB66F45C5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:qnap:qts:4.3.6.1286:build_20200422:*:*:*:*:*:*",
"matchCriteriaId": "E22A7A54-3FBD-4FF5-842B-20CDEF56EF37",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:qnap:qts:4.3.6.1333:build_20200608:*:*:*:*:*:*",
"matchCriteriaId": "40551635-979F-4D0A-B8F2-F640073091E6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:qnap:qts:4.3.6.1411:build_20200825:*:*:*:*:*:*",
"matchCriteriaId": "2D56EDE7-E16F-4EE6-AD88-0901687F2DAB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:qnap:qts:4.3.6.1446:build_20200929:*:*:*:*:*:*",
"matchCriteriaId": "D3816896-A891-45AF-BE47-3D2857DAC541",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:qnap:qts:4.3.6.1620:build_20210322:*:*:*:*:*:*",
"matchCriteriaId": "5F01EA3A-CC9B-406E-8643-6054ABE9AD52",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:qnap:qts:4.3.6.1663:build_20210504:*:*:*:*:*:*",
"matchCriteriaId": "D8AA595A-36CA-490F-B6BD-9D896F58FF2A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:qnap:qts:4.3.6.1711:build_20210621:*:*:*:*:*:*",
"matchCriteriaId": "2214698A-09DB-40F5-ABDA-55CEB759ACFF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:qnap:qts:4.3.6.1750:build_20210730:*:*:*:*:*:*",
"matchCriteriaId": "232782BB-25D4-4BD1-AAF0-22530CE2C82B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:qnap:qts:4.3.6.1831:build_20211019:*:*:*:*:*:*",
"matchCriteriaId": "B754C198-F85C-401B-995B-D61A73057F5F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:qnap:qts:4.3.6.1907:build_20220103:*:*:*:*:*:*",
"matchCriteriaId": "61CAA378-3236-46B4-8A14-092EFF921073",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:qnap:qts:4.3.6.1965:build_20220302:*:*:*:*:*:*",
"matchCriteriaId": "63D954BB-F6C4-4C3A-9E71-F34E53B8E764",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:qnap:qts:4.3.6.2050:build_20220526:*:*:*:*:*:*",
"matchCriteriaId": "E252DEAA-10C0-4A7D-B66A-1C9ABFC042C5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:qnap:qts:4.3.6.2232:build_20221124:*:*:*:*:*:*",
"matchCriteriaId": "B8099233-501E-41E8-BBDA-0F5C6BDC0FDE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:qnap:qts:4.3.6.2441:build_20230621:*:*:*:*:*:*",
"matchCriteriaId": "E5E98E02-D677-4E31-A498-C18E64816F6C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:qnap:qts:4.3.6.2665:build_20240131:*:*:*:*:*:*",
"matchCriteriaId": "7C41F264-FD5E-481C-BF90-6EEA634E554C",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:qnap:qts:4.3.4.0899:build_20190322:*:*:*:*:*:*",
"matchCriteriaId": "971833DE-934A-4BB5-AA50-E424A3D4EE49",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:qnap:qts:4.3.4.1029:build_20190730:*:*:*:*:*:*",
"matchCriteriaId": "8CF7C63D-18EE-4297-980C-72111832DBA9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:qnap:qts:4.3.4.1082:build_20190921:*:*:*:*:*:*",
"matchCriteriaId": "ED6B6071-8D91-466D-80DB-1620CE9202D5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:qnap:qts:4.3.4.1190:build_20200107:*:*:*:*:*:*",
"matchCriteriaId": "71B9DEEF-D85C-46CE-B0D4-902397B8CD96",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:qnap:qts:4.3.4.1282:build_20200408:*:*:*:*:*:*",
"matchCriteriaId": "DB07475A-7C40-450F-85BE-D8A8F7434C0A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:qnap:qts:4.3.4.1368:build_20200703:*:*:*:*:*:*",
"matchCriteriaId": "D8A4458A-136F-483D-98D4-43568EC4FC0F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:qnap:qts:4.3.4.1417:build_20200821:*:*:*:*:*:*",
"matchCriteriaId": "D26CD586-13C5-4F77-9DC0-3565A3FF7F60",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:qnap:qts:4.3.4.1463:build_20201006:*:*:*:*:*:*",
"matchCriteriaId": "6390A450-25B5-41CC-9866-1AC81ECD0DC5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:qnap:qts:4.3.4.1632:build_20210324:*:*:*:*:*:*",
"matchCriteriaId": "DD5F45E0-8DE4-4DF0-AF65-DE8149E2B738",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:qnap:qts:4.3.4.1652:build_20210413:*:*:*:*:*:*",
"matchCriteriaId": "CE252780-1A93-4211-91E3-CE46B26EC2AA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:qnap:qts:4.3.4.1976:build_20220303:*:*:*:*:*:*",
"matchCriteriaId": "C2103CD3-4E85-4C08-A73C-EE5392682027",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:qnap:qts:4.3.4.2107:build_20220712:*:*:*:*:*:*",
"matchCriteriaId": "E21AE5D2-93C8-49AF-A88D-F8C561B76857",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:qnap:qts:4.3.4.2242:build_20221124:*:*:*:*:*:*",
"matchCriteriaId": "D7268137-D207-4294-9CD1-BA776AE9606E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:qnap:qts:4.3.4.2451:build_20230621:*:*:*:*:*:*",
"matchCriteriaId": "275EE698-6440-4980-92E3-52479EB08CE7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:qnap:qts:4.3.4.2675:build_20240131:*:*:*:*:*:*",
"matchCriteriaId": "F86DE576-C9BF-46C4-BFBF-67C34F173B97",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:qnap:qts:4.3.3.0174:build_20170503:*:*:*:*:*:*",
"matchCriteriaId": "3686F6D2-9F42-489A-B4FF-9CDF127BD2F4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:qnap:qts:4.3.3.0868:build_20190322:*:*:*:*:*:*",
"matchCriteriaId": "08C2B922-0B29-41FA-9FA7-5821713541E4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:qnap:qts:4.3.3.0998:build_20190730:*:*:*:*:*:*",
"matchCriteriaId": "32BFAA90-8807-4D5E-B150-0760F682C6D7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:qnap:qts:4.3.3.1051:build_20190921:*:*:*:*:*:*",
"matchCriteriaId": "5F26EEEF-EDCD-4E7F-8F66-FD44B6521663",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:qnap:qts:4.3.3.1098:build_20191107:*:*:*:*:*:*",
"matchCriteriaId": "81652269-F0DB-4350-8DC0-4CC203C1DF11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:qnap:qts:4.3.3.1161:build_20200109:*:*:*:*:*:*",
"matchCriteriaId": "B1DCFEFF-AB18-4B4E-9B99-9DBDC5AF49CB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:qnap:qts:4.3.3.1252:build_20200409:*:*:*:*:*:*",
"matchCriteriaId": "9951A1AF-4B46-4D9D-B6C5-2BCB15BD070C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:qnap:qts:4.3.3.1315:build_20200611:*:*:*:*:*:*",
"matchCriteriaId": "0AB586D1-CF9F-4C87-B604-6A9DB9657D76",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:qnap:qts:4.3.3.1386:build_20200821:*:*:*:*:*:*",
"matchCriteriaId": "6D3650DB-205C-4B13-BDFC-E56172DD4156",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:qnap:qts:4.3.3.1432:build_20201006:*:*:*:*:*:*",
"matchCriteriaId": "ECD41187-A0AF-41E8-A884-E605C6CF7DFE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:qnap:qts:4.3.3.1624:build_20210416:*:*:*:*:*:*",
"matchCriteriaId": "DC95BBCC-A0D8-42FB-880F-5155655519C3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:qnap:qts:4.3.3.1677:build_20210608:*:*:*:*:*:*",
"matchCriteriaId": "7D84B904-55E9-414A-9CBC-232EADD08E88",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:qnap:qts:4.3.3.1693:build_20210624:*:*:*:*:*:*",
"matchCriteriaId": "1FA8C7BD-C123-484A-8317-37AE1C68D110",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:qnap:qts:4.3.3.1799:build_20211008:*:*:*:*:*:*",
"matchCriteriaId": "C0BAF780-8DD3-4AC4-86CF-A2FD903EA171",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:qnap:qts:4.3.3.1864:build_20211212:*:*:*:*:*:*",
"matchCriteriaId": "F25FEB20-22E9-41B5-B310-21C95D29C604",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:qnap:qts:4.3.3.1945:build_20220303:*:*:*:*:*:*",
"matchCriteriaId": "82EE2EC6-F5EA-4E6A-B24A-C9D5925B4EA1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:qnap:qts:4.3.3.2057:build_20220623:*:*:*:*:*:*",
"matchCriteriaId": "2C735F47-4409-47E9-B616-31BADC64EB5E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:qnap:qts:4.3.3.2211:build_20221124:*:*:*:*:*:*",
"matchCriteriaId": "BEC5C7EC-0055-4D83-B700-6BB571139761",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:qnap:qts:4.3.3.2420:build_20230621:*:*:*:*:*:*",
"matchCriteriaId": "58ADDC0D-9550-4713-A068-A39D001F84FD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:qnap:qts:4.3.3.2644:build_20240131:*:*:*:*:*:*",
"matchCriteriaId": "62168CE8-D892-4291-B85B-EA171BBB9074",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:qnap:qts:4.2.6:build_20170517:*:*:*:*:*:*",
"matchCriteriaId": "8F523E9F-D101-4C29-A624-74E1F3F8CB7D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:qnap:qts:4.2.6:build_20190322:*:*:*:*:*:*",
"matchCriteriaId": "1388DBE0-F6BB-44AB-81AC-BFB4E70BE820",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:qnap:qts:4.2.6:build_20190730:*:*:*:*:*:*",
"matchCriteriaId": "CF3C4461-C1B6-43A1-BA5E-D6658EFD06EE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:qnap:qts:4.2.6:build_20190921:*:*:*:*:*:*",
"matchCriteriaId": "A1F11848-6FED-4D58-A177-36D280C0347C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:qnap:qts:4.2.6:build_20191107:*:*:*:*:*:*",
"matchCriteriaId": "F6259C86-FFDA-40E8-AF0C-33CC8C108DC9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:qnap:qts:4.2.6:build_20200109:*:*:*:*:*:*",
"matchCriteriaId": "9E01E157-BDF1-4B00-BA9B-6887C0C7DFF2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:qnap:qts:4.2.6:build_20200421:*:*:*:*:*:*",
"matchCriteriaId": "1D1E5368-9587-4E0A-BB65-D88069CA8490",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:qnap:qts:4.2.6:build_20200611:*:*:*:*:*:*",
"matchCriteriaId": "B63CE419-871C-4866-8AB1-4BB6461E1D74",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:qnap:qts:4.2.6:build_20200821:*:*:*:*:*:*",
"matchCriteriaId": "886A71D1-9615-47A5-B3C2-CBC6F02961A4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:qnap:qts:4.2.6:build_20210327:*:*:*:*:*:*",
"matchCriteriaId": "9B7A506C-1F53-4CEC-9828-9327352DE153",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:qnap:qts:4.2.6:build_20211215:*:*:*:*:*:*",
"matchCriteriaId": "060D81A5-599A-4329-99C8-D69725C65AF3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:qnap:qts:4.2.6:build_20220304:*:*:*:*:*:*",
"matchCriteriaId": "DB41EDDB-E185-4E3F-9497-3826A7955BBE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:qnap:qts:4.2.6:build_20220623:*:*:*:*:*:*",
"matchCriteriaId": "86830BEE-D24C-4618-9070-EA968D533096",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:qnap:qts:4.2.6:build_20221028:*:*:*:*:*:*",
"matchCriteriaId": "5FDF9A85-F956-4C2F-80FD-E5D899761A15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:qnap:qts:4.2.6:build_20230621:*:*:*:*:*:*",
"matchCriteriaId": "F80B7DEF-3EB6-4C48-B0A6-108211B34BFF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:qnap:qts:4.2.6:build_20240131:*:*:*:*:*:*",
"matchCriteriaId": "4467FB2F-9A18-4211-A251-C4FCDB18CAA5",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "An OS command injection vulnerability has been reported to affect legacy QTS. If exploited, the vulnerability could allow authenticated administrators to execute commands via a network.\n\nWe have already fixed the vulnerability in the following versions:\nQTS 4.3.6.2805 build 20240619 and later\nQTS 4.3.4.2814 build 20240618 and later\nQTS 4.3.3.2784 build 20240619 and later\nQTS 4.2.6 build 20240618 and later"
},
{
"lang": "es",
"value": "Se ha informado de una vulnerabilidad de inyecci\u00f3n de comandos del sistema operativo que afecta a la versi\u00f3n anterior de QTS. Si se explota, la vulnerabilidad podr\u00eda permitir que los administradores autenticados ejecuten comandos a trav\u00e9s de una red. Ya hemos corregido la vulnerabilidad en las siguientes versiones: QTS 4.3.6.2805, compilaci\u00f3n 20240619 y posteriores QTS 4.3.4.2814, compilaci\u00f3n 20240618 y posteriores QTS 4.3.3.2784, compilaci\u00f3n 20240619 y posteriores QTS 4.2.6, compilaci\u00f3n 20240618 y posteriores"
}
],
"id": "CVE-2023-39300",
"lastModified": "2026-06-17T06:11:59.170",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 1.2,
"impactScore": 5.9,
"source": "security@qnapsecurity.com.tw",
"type": "Secondary"
},
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 1.2,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2023-39300",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-09-06T17:35:15.918021Z",
"version": "2.0.3"
}
}
]
},
"published": "2024-09-06T17:15:12.070",
"references": [
{
"source": "security@qnapsecurity.com.tw",
"tags": [
"Vendor Advisory"
],
"url": "https://www.qnap.com/en/security-advisory/qsa-24-26"
}
],
"sourceIdentifier": "security@qnapsecurity.com.tw",
"vulnStatus": "Analyzed",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-78"
}
],
"source": "security@qnapsecurity.com.tw",
"type": "Secondary"
}
]
}
},
"redhat_vex": {
"current_release_date": "2025-05-28T23:40:01+00:00",
"cve": "CVE-2023-39300",
"id": "CVE-2023-39300",
"initial_release_date": "2023-01-01T00:00:00+00:00",
"product_status:known_not_affected": "1",
"source": "Red Hat CSAF VEX",
"status": "final",
"title": "QTS",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2023/cve-2023-39300.json",
"version": "3"
},
"vulnrichment": {
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:o:qnap:qts:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "qts",
"vendor": "qnap",
"versions": [
{
"lessThan": "4.3.6.2805_build_20240619",
"status": "affected",
"version": "4.3.6",
"versionType": "custom"
},
{
"lessThan": "4.3.4.2814_build_20240618",
"status": "affected",
"version": "4.3.4",
"versionType": "custom"
},
{
"lessThan": "4.3.3.2784_build_20240619",
"status": "affected",
"version": "4.3.3",
"versionType": "custom"
},
{
"lessThan": "4.2.6_build_20240618",
"status": "affected",
"version": "4.2.6",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-39300",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-09-06T17:35:15.918021Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-09-06T17:39:21.412Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "QTS",
"vendor": "QNAP Systems Inc.",
"versions": [
{
"lessThan": "4.3.6.2805 build 20240619",
"status": "affected",
"version": "4.3.6",
"versionType": "custom"
},
{
"lessThan": "4.3.4.2814 build 20240618",
"status": "affected",
"version": "4.3.4",
"versionType": "custom"
},
{
"lessThan": "4.3.3.2784 build 20240619",
"status": "affected",
"version": "4.3.3",
"versionType": "custom"
},
{
"lessThan": "4.2.6 build 20240618",
"status": "affected",
"version": "4.2.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "QTS",
"vendor": "QNAP Systems Inc.",
"versions": [
{
"status": "unaffected",
"version": "5.x"
},
{
"status": "unaffected",
"version": "4.5.x"
}
]
},
{
"defaultStatus": "unaffected",
"product": "QuTS hero",
"vendor": "QNAP Systems Inc.",
"versions": [
{
"status": "unaffected",
"version": "h5.x"
},
{
"status": "unaffected",
"version": "h4.5.x"
}
]
},
{
"defaultStatus": "unaffected",
"product": "QuTScloud",
"vendor": "QNAP Systems Inc.",
"versions": [
{
"status": "unaffected",
"version": "c5.x"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Arseniy Sharoglazov"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "An OS command injection vulnerability has been reported to affect legacy QTS. If exploited, the vulnerability could allow authenticated administrators to execute commands via a network.\u003cbr\u003e\u003cbr\u003eWe have already fixed the vulnerability in the following versions:\u003cbr\u003eQTS 4.3.6.2805 build 20240619 and later\u003cbr\u003eQTS 4.3.4.2814 build 20240618 and later\u003cbr\u003eQTS 4.3.3.2784 build 20240619 and later\u003cbr\u003eQTS 4.2.6 build 20240618 and later\u003cbr\u003e"
}
],
"value": "An OS command injection vulnerability has been reported to affect legacy QTS. If exploited, the vulnerability could allow authenticated administrators to execute commands via a network.\n\nWe have already fixed the vulnerability in the following versions:\nQTS 4.3.6.2805 build 20240619 and later\nQTS 4.3.4.2814 build 20240618 and later\nQTS 4.3.3.2784 build 20240619 and later\nQTS 4.2.6 build 20240618 and later"
}
],
"impacts": [
{
"capecId": "CAPEC-88",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-88"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "CWE-78",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-09-06T16:27:04.275Z",
"orgId": "2fd009eb-170a-4625-932b-17a53af1051f",
"shortName": "qnap"
},
"references": [
{
"url": "https://www.qnap.com/en/security-advisory/qsa-24-26"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "We have already fixed the vulnerability in the following versions:\u003cbr\u003eQTS 4.3.6.2805 build 20240619 and later\u003cbr\u003eQTS 4.3.4.2814 build 20240618 and later\u003cbr\u003eQTS 4.3.3.2784 build 20240619 and later\u003cbr\u003eQTS 4.2.6 build 20240618 and later\u003cbr\u003e"
}
],
"value": "We have already fixed the vulnerability in the following versions:\nQTS 4.3.6.2805 build 20240619 and later\nQTS 4.3.4.2814 build 20240618 and later\nQTS 4.3.3.2784 build 20240619 and later\nQTS 4.2.6 build 20240618 and later"
}
],
"source": {
"advisory": "QSA-24-26",
"discovery": "EXTERNAL"
},
"title": "QTS",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "2fd009eb-170a-4625-932b-17a53af1051f",
"assignerShortName": "qnap",
"cveId": "CVE-2023-39300",
"datePublished": "2024-09-06T16:27:04.275Z",
"dateReserved": "2023-07-27T06:46:01.477Z",
"dateUpdated": "2024-09-06T17:44:00.200Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
}
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.
Loading…