QTS, Multimedia Console, and Media Streaming add-on

published 2023-11-03 3 y ago modified 2026-06-17 4 mo ago also EUVD-2023-27469

cvss: 9.0; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 14.1%; EPSS 14.1% chance of exploitation in 30 days, percentile 96%
public exploits: 0; none known

An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow users to execute commands via a network.

We have already fixed the vulnerability in the following versions: Multimedia Console 2.1.2 ( 2023/05/04 ) and later Multimedia Console 1.4.8 ( 2023/05/05 ) and later QTS 5.1.0.2399 build 20230515 and later QTS 4.3.6.2441 build 20230621 and later QTS 4.3.4.2451 build 20230621 and later QTS 4.3.3.2420 build 20230621 and later QTS 4.2.6 build 20230621 and later Media Streaming add-on 500.1.1.2 ( 2023/06/12 ) and later Media Streaming add-on 500.0.0.11 ( 2023/06/16 ) and later

Patch / fix

fixed in 3

QNAP Systems Inc. Multimedia Console 1.4.8 ( 2023/05/05 ), 2.1.2 ( 2023/05/04 )
QNAP Systems Inc. QTS 4.2.6 build 20230621, 4.3.3.2420 build 20230621, 4.3.4.2451 build 20230621, 4.3.6.2441 build 20230621, 5.1.0.2399 build 20230515
QNAP Systems Inc. Media Streaming add-on 500.0.0.11 ( 2023/06/16 ), 500.1.1.2 ( 2023/06/12 )

CISA SSVC

Exploitation: none
Automatable: no
Technical impact: total
Assessed: 20 mo ago (2025-02-26)

Exploit prediction

14.15% chance of exploitation in the next 30 days, higher than 96% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	3.1	9.0	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
NVD	3.1	9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

QNAP Systems Inc. Multimedia Console
QNAP Systems Inc. QTS
QNAP Systems Inc. Media Streaming add-on

Classification

Weakness

CWE-77 Improper Neutralization of Special Elements used in a Command
CWE-78 Improper Neutralization of Special Elements used in an OS Command

References

qnap.com /en/security-advisory/qsa-23-35
vendor-advisory

Sources

CVE List CVE-2023-23369
NVD CVE-2023-23369

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary