Fixes have been issued by QNAP for two critical command injection vulnerabilities affecting its network-attached storage devices, which could be leveraged to facilitate arbitrary code execution, reports The Hacker News. QNAP QTS 4.5.x and 5.0.x, QuTS hero h4.5x and h5.0x, and QuTScloud c5.0x have been impacted by the first flaw, tracked as CVE-2023-23368, while the second bug, tracked as CVE-2023-23369, has affected QTS 4.2.x, 4.3.3, 4.3.4, 4.3.6, and 5.1.x, as well as Multimedia Console 1.4.x and 2.1.x, and Media Streaming add-on 500.0.x and 500.1.x, according to QNAP.

Source: SC Magazine