Is CVE-2023-23369 actively exploited?

No active exploitation of CVE-2023-23369 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2023-23369 be exploited remotely?

Yes. CVE-2023-23369 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2023-23369?

CVE-2023-23369 has a CVSS score of 9.8 (CRITICAL).

HOME VULNERABILITIESCVE-2023-23369

CRITICAL

CVE-2023-23369

CWE-77Published: November 3, 2023· Updated: Jun 17, 2026

9.8

CVSS v3.1

Official Description

An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow users to execute commands via a network.

We have already fixed the vulnerability in the following versions:

Multimedia Console 2.1.2 ( 2023/05/04 ) and later

Multimedia Console 1.4.8 ( 2023/05/05 ) and later

QTS 5.1.0.2399 build 20230515 and later

QTS 4.3.6.2441 build 20230621 and later

QTS 4.3.4.2451 build 20230621 and later

QTS 4.3.3.2420 build 20230621 and later

QTS 4.2.6 build 20230621 and later

Media Streaming add-on 500.1.1.2 ( 2023/06/12 ) and later

Media Streaming add-on 500.0.0.11 ( 2023/06/16 ) and later

NVD Source

Risk Analysis

This vulnerability is an OS command injection flaw affecting various QNAP operating systems. With a critical CVSS score of 9.8, it allows unauthenticated remote attackers to execute arbitrary commands, posing a severe risk to system integrity and confidentiality.

There is no known public exploit for this vulnerability, and it is not currently listed in CISA's KEV catalog. It is remotely exploitable due to its network-based attack vector and low complexity.

Recommended Action

Users should update their QNAP devices to the specified patched versions of QTS, Multimedia Console, or the Media Streaming add-on.

Generated by the CTIWATCH analysis pipeline from this CVE's metadata (CVSS, EPSS, KEV status, exploit intelligence). Verify against vendor advisories before acting.

Technical Analysis

CVE-2023-23369 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.

A successful exploit results in complete confidentiality breach (data exposure), full integrity compromise (data manipulation), availability disruption (denial of service), with a CVSS base score of 9.8.