CVE-2023-30801

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2023-30801
All versions of the qBittorrent client through 4.5.5 use default credentials when the web user interface is enabled. The administrator is not forced to change the default credentials. As of 4.5.5, this issue has not been fixed. A remote attacker can use the default credentials to authenticate and execute arbitrary operating system commands using the "external program" feature in the web user interface. This was reportedly exploited in the wild in March 2023.

9.8 /10

CVSS v3.0 : CRITICAL

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://github.com/qbittorrent/qBittorrent/issues/18731 Issue Tracking
https://github.com/qbittorrent/qBittorrent/issues/18731 Issue Tracking
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/T5WXBKELVZFZNIDONIJESOCSRPIQNCGI/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/T5WXBKELVZFZNIDONIJESOCSRPIQNCGI/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/U4BNFJR3ZWVLE2YSYIQYBWVDQBBZOLEL/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/U4BNFJR3ZWVLE2YSYIQYBWVDQBBZOLEL/
https://vulncheck.com/advisories/qbittorrent-default-creds Third Party Advisory
https://vulncheck.com/advisories/qbittorrent-default-creds Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:qbittorrent:qbittorrent:*:*:*:*:*:*:*:*
History

13 Feb 2025, 17:16

Type Values Removed Values Added
Summary All versions of the qBittorrent client through 4.5.5 use default credentials when the web user interface is enabled. The administrator is not forced to change the default credentials. As of 4.5.5, this issue has not been fixed. A remote attacker can use the default credentials to authenticate and execute arbitrary operating system commands using the "external program" feature in the web user interface. This was reportedly exploited in the wild in March 2023. All versions of the qBittorrent client through 4.5.5 use default credentials when the web user interface is enabled. The administrator is not forced to change the default credentials. As of 4.5.5, this issue has not been fixed. A remote attacker can use the default credentials to authenticate and execute arbitrary operating system commands using the "external program" feature in the web user interface. This was reportedly exploited in the wild in March 2023.
References (MISC) https://github.com/qbittorrent/qBittorrent/issues/18731 - Issue Tracking () https://github.com/qbittorrent/qBittorrent/issues/18731 - Issue Tracking
References (MISC) https://vulncheck.com/advisories/qbittorrent-default-creds - Third Party Advisory () https://vulncheck.com/advisories/qbittorrent-default-creds - Third Party Advisory

30 Nov 2023, 04:15

Type Values Removed Values Added
References
  • () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/T5WXBKELVZFZNIDONIJESOCSRPIQNCGI/ -
  • () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/U4BNFJR3ZWVLE2YSYIQYBWVDQBBZOLEL/ -

18 Oct 2023, 02:17

Type Values Removed Values Added
New CVE
Information

Published : 2023-10-10 14:15

Updated : 2025-02-13 17:16

NVD link : CVE-2023-30801

Mitre link : CVE-2023-30801

JSON object : View

Products Affected

qbittorrent

  • qbittorrent
CWE
CWE-798

Use of Hard-coded Credentials