CVE-2023-47220: Media Streaming add-on

CVE-2023-47220 PUBLISHED CVSS 6.6 MEDIUM

Media Streaming add-on

Reported by qnap · Published May 3, 2024

An OS command injection vulnerability has been reported to affect Media Streaming add-on. If exploited, the vulnerability could allow authenticated administrators to execute commands via a network. We have already fixed the vulnerability in the following version: Media Streaming add-on 500.1.1.5 ( 2024/01/22 ) and later

Risk scores

CVSS 3.1

6.6

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L

Affected products

Vendor	Product	Versions
QNAP Systems Inc.	Media Streaming add-on	500.1.x
QNAP Systems Inc.	Media Streaming add-on	500.1.x
qnap	media_streaming_add-on	500.1*

Timeline

May 3, 2024 CVE Published
May 3, 2024 EPSS Score (30 in total, the first dated here)
Mar 30, 2026 Security Advisory
Jul 31, 2026 Coalition ESS Score

Query this with the API

The same record, from the CLI:

vulnetix vdb vuln CVE-2023-47220
vulnetix vdb fixes CVE-2023-47220

Or with curl, using the org id and key from your account page:

curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
  "https://api.vdb.vulnetix.com/v2/vuln/CVE-2023-47220/fixes/registry"

The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart

References

Look up in the Resolve Platform →