High Severity Vulnerability in QNAP Devices

Summary

A critical severity vulnerability in several versions of the QNAP QTS operating system and applications could allow threat actors to execute commands. CVE-2023-23368 is a CVSSv3.1 9.8/10 flaw that can be exploited remotely by an unauthenticated threat actor without user interaction. Impacted QNAP versions include QTS 5.0.x, QTS 4.5.x, QuTS hero h5.0.x, QuTS hero h4.5.x, and QuTScloud c5.0.x. While no exploit or proof-of-concept code has been publicized, QNAP vulnerabilities have been widely used to facilitate ransomware attacks. There are approximately 390 public-facing QNAP QTS devices in New Jersey.

Recommendations

The NJCCIC highly recommends that QNAP administrators update impacted devices to the most current patch levels as soon as possible after appropriate testing and review the QNAP security advisory for additional information.