CVE-2023-30801 qBittorrent Web UI Default Credentials Lead to RCE
Remote attackers can exploit default Web UI credentials to execute arbitrary OS commands via the external program feature in qBittorrent.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-30801?
CVE-2023-30801 is a critical vulnerability in qBittorrent client, published on 10 Oct 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
All versions of the qBittorrent client through 4.5.5 use default credentials when the web user interface is enabled. The administrator is not forced to change the default credentials. As of 4.5.5, this issue has not been fixed. A remote attacker can use the default credentials to authenticate and execute arbitrary operating system commands using the "external program" feature in the web user interface. This was reportedly exploited in the wild in March 2023.
Which versions are affected by CVE-2023-30801?
It affects 1 product.
Linux distribution packages (8)
libtorrent-rasterbar SUSE:Package Hub 15 SP4 | All versions | 2.0.9-bp155.2.3.1 |
qbittorrent SUSE:Package Hub 15 SP4 | All versions | 4.6.2-bp155.2.3.1 |
libtorrent-rasterbar SUSE:Package Hub 15 SP5 | All versions | 2.0.9-bp155.2.3.1 |
qbittorrent SUSE:Package Hub 15 SP5 | All versions | 4.6.2-bp155.2.3.1 |
libtorrent-rasterbar openSUSE:Leap 15.4 | All versions | 2.0.9-bp155.2.3.1 |
qbittorrent openSUSE:Leap 15.4 | All versions | 4.6.2-bp155.2.3.1 |
libtorrent-rasterbar openSUSE:Leap 15.5 | All versions | 2.0.9-bp155.2.3.1 |
qbittorrent openSUSE:Leap 15.5 | All versions | 4.6.2-bp155.2.3.1 |
Products include Qbittorrent Qbittorrent.
How do I fix CVE-2023-30801?
Change a configuration setting.
Is CVE-2023-30801 being exploited?
There is no known exploitation of CVE-2023-30801 in the wild and no public exploit code.
Other vulnerabilities in qBittorrent client
Sources
Also known as DEBIAN-CVE-2023-30801, GHSA-vchq-5hmx-6hmp, UBUNTU-CVE-2023-30801, openSUSE-SU-2023:0391-1, openSUSE-SU-2024:13477-1.