Critical severity · published Sep 22, 2023
CVE-2023-23364
A buffer copy without checking size of input vulnerability has been reported to affect QNAP operating systems
9.8
CVSS
0.9%
EPSS
No
On KEV
Description
A buffer copy without checking size of input vulnerability has been reported to affect QNAP operating systems. If exploited, the vulnerability possibly allows remote users to execute code via unspecified vectors.
We have already fixed the vulnerability in the following versions:
Multimedia Console 2.1.1 ( 2023/03/29 ) and later
Multimedia Console 1.4.7 ( 2023/03/20 ) and later
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.9% · higher than 60% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MC
Multimedia Console · Qnap
before 1.4.7; 2.0.0 before 2.1.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-23364
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-23364
Vendor Advisory
https://www.qnap.com/en/security-advisory/qsa-23-29
More from Multimedia Console
9.8
CVE-2023-23369
An OS command injection vulnerability has been reported to affect several QNAP operating system versions
9.8
CVE-2021-38684
A stack buffer overflow vulnerability has been reported to affect QNAP NAS running Multimedia Console
9.8
CVE-2020-36195
An SQL injection vulnerability has been reported to affect QNAP NAS running Multimedia Console or the Media Streaming add-on
6.1
CVE-2020-2493
This cross-site scripting vulnerability in Multimedia Console allows remote attackers to inject malicious code