CVE-2023-45025
CRITICALDescription
An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow users to execute commands via a network. We have already fixed the vulnerability in the following versions: QTS 5.1.4.2596 build 20231128 and later QTS 4.5.4.2627 build 20231225 and later QuTS hero h5.1.4.2596 build 20231128 and later QuTS hero h4.5.4.2626 build 20231225 and later QuTScloud c5.1.5.2651 and later
Is your site exposed to CVE-2023-45025?
Run a free security scan — no signup, results in seconds.
CVSS v3.1 Score
Weakness Type (CWE)
Affected Products
| Vendor | Product |
|---|---|
| qnap | qts |
| qnap | qts |
| qnap | qts |
| qnap | qts |
| qnap | qts |
| qnap | qts |
| qnap | qts |
| qnap | qts |
| qnap | qts |
| qnap | qts |
| qnap | qts |
| qnap | qts |
| qnap | qts |
| qnap | qts |
| qnap | qts |
| qnap | qts |
| qnap | qts |
| qnap | qts |
| qnap | qts |
| qnap | qts |
| qnap | qts |
| qnap | quts_hero |
| qnap | quts_hero |
| qnap | quts_hero |
| qnap | quts_hero |
| qnap | quts_hero |
| qnap | quts_hero |
| qnap | quts_hero |
| qnap | quts_hero |
| qnap | quts_hero |
| qnap | quts_hero |
| qnap | quts_hero |
| qnap | quts_hero |
| qnap | quts_hero |
| qnap | quts_hero |
| qnap | quts_hero |
| qnap | quts_hero |
| qnap | quts_hero |
| qnap | quts_hero |
| qnap | quts_hero |
| qnap | quts_hero |
| qnap | quts_hero |
| qnap | quts_hero |
| qnap | quts_hero |
| qnap | qutscloud |
References
Frequently Asked Questions
What is CVE-2023-45025? +
How severe is CVE-2023-45025? +
What products are affected by CVE-2023-45025? +
How do I check if I'm vulnerable to CVE-2023-45025? +
Related Vulnerabilities
Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to versions 0.4.24, 0.5.14, and 0.6.4, symbol arguments …
launch-editor allows users to open files with line numbers in editor from Node.js. Prior to version 2.9.0, due to the …
Honeywell OneWireless Wireless Device Manager (WDM) for the following versions R310.x, R320.x, R321.x, R322.1, R322.2, R323.x, R330.1 contains a command …
Terraform WinDNS Provider allows users to manage their Windows DNS server resources through Terraform. A security issue has been found …
The Evertz SDVN 3080ipx-10G is a High Bandwidth Ethernet Switching Fabric for Video Application. This device exposes a web management …
A vulnerability in the web-based management interface of multiple Ligowave devices could allow an authenticated remote attacker to execute arbitrary …