CVE-2023-34975

CVSS 3.1 Score 8.8 of 10 (high)

Details

Published Oct 13, 2023
Updated: Mar 8, 2024
CWE ID 78
CWE ID 89

Summary

CVE-2023-34975 is a newly discovered OS command injection vulnerability that can impact various QNAP operating system versions. This issue poses a risk for authenticated administrators, allowing them to execute network-based commands if exploited. It is important to note that QuTScloud c5.1.x is not affected by this vulnerability. Fortunately, QNAP has already released patches to address this issue. The affected operating system versions should be updated to QuTS hero h4.5.4.2626 build 20231225 or later, and QTS 4.5.4.2627 build 20231225 or later to mitigate this risk.

Ligh bulbPrevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.

Share

Affected Products

  • QNAP Video Station

Affected Vendors

  • QNAP Systems