QNAP addresses critical vulnerabilities in its products

QNAP has addressed two critical command injection vulnerabilities, tracked as CVE-2023-23368 and CVE-2023-23369, that impact the QTS operating system and applications on its network-attached storage (NAS) devices.

The vulnerability CVE-2023-23368 with a CVSS score 9.8 is an OS command injection issue that could be exploited by a remote attacker to execute commands via a network.

An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote attackers to execute commands via a network.

The vulnerability CVE-2023-23369 with a CVSS score 9.0 could be exploited by a remote attacker to execute commands via a network.

An OS command injection vulnerability has been reported to affect several QNAP operating systems and application versions. If exploited, the vulnerability could allow remote attackers to execute commands via a network.

Customers are urged to address both vulnerabilities to prevent threat actors from exploiting them to take over devices running the vulnerable software.