CVE-2023-30801

All versions of the qBittorrent client through 4.5.5 use default credentials when the web user interface is enabled. The administrator is not forced to change the default credentials. As of 4.5.5, this issue has not been fixed. A remote attacker can use the default credentials to authenticate and execute arbitrary operating system commands using the "external program" feature in the web user interface. This was reportedly exploited in the wild in March 2023.

All versions of the qBittorrent client through 4.5.5 use default credentials when the web user interface is enabled. The administrator is not forced to change the default credentials. As of 4.5.5, this issue has not been fixed. A remote attacker can use the default credentials to authenticate and execute arbitrary operating system commands using the "external program" feature in the web user interface. This was reportedly exploited in the wild in March 2023.

Todas las versiones del cliente qBittorrent hasta la 4.5.5 utilizan credenciales predeterminadas cuando la interfaz de usuario web está habilitada. El administrador no está obligado a cambiar las credenciales predeterminadas. A partir de 4.5.5, este problema no se ha solucionado. Un atacante remoto puede utilizar las credenciales predeterminadas para autenticar y ejecutar comandos arbitrarios del sistema operativo utilizando la función "programa externo" en la interfaz de usuario web. Según se informa, esto fue explotado salvajemente en marzo de 2023.