Critical severity9.8NVD Advisory· Published Oct 10, 2023· Updated Jun 17, 2026
CVE-2023-30801
CVE-2023-30801
Description
All versions of the qBittorrent client through 4.5.5 use default credentials when the web user interface is enabled. The administrator is not forced to change the default credentials. As of 4.5.5, this issue has not been fixed. A remote attacker can use the default credentials to authenticate and execute arbitrary operating system commands using the "external program" feature in the web user interface. This was reportedly exploited in the wild in March 2023.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
10<=4.5.5+ 1 more
- (no CPE)range: <=4.5.5
- (no CPE)range: 0
- osv-coords8 versionspkg:rpm/opensuse/libtorrent-rasterbar&distro=openSUSE%20Leap%2015.4pkg:rpm/opensuse/libtorrent-rasterbar&distro=openSUSE%20Leap%2015.5pkg:rpm/opensuse/qbittorrent&distro=openSUSE%20Leap%2015.4pkg:rpm/opensuse/qbittorrent&distro=openSUSE%20Leap%2015.5pkg:rpm/suse/libtorrent-rasterbar&distro=SUSE%20Package%20Hub%2015%20SP4pkg:rpm/suse/libtorrent-rasterbar&distro=SUSE%20Package%20Hub%2015%20SP5pkg:rpm/suse/qbittorrent&distro=SUSE%20Package%20Hub%2015%20SP4pkg:rpm/suse/qbittorrent&distro=SUSE%20Package%20Hub%2015%20SP5
< 2.0.9-bp155.2.3.1+ 7 more
- (no CPE)range: < 2.0.9-bp155.2.3.1
- (no CPE)range: < 2.0.9-bp155.2.3.1
- (no CPE)range: < 4.6.2-bp155.2.3.1
- (no CPE)range: < 4.6.2-bp155.2.3.1
- (no CPE)range: < 2.0.9-bp155.2.3.1
- (no CPE)range: < 2.0.9-bp155.2.3.1
- (no CPE)range: < 4.6.2-bp155.2.3.1
- (no CPE)range: < 4.6.2-bp155.2.3.1
Patches
Vulnerability mechanics
References
4- vulncheck.com/advisories/qbittorrent-default-credsnvdThird Party Advisory
- github.com/qbittorrent/qBittorrent/issues/18731nvdIssue Tracking
- lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/T5WXBKELVZFZNIDONIJESOCSRPIQNCGI/nvd
- lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/U4BNFJR3ZWVLE2YSYIQYBWVDQBBZOLEL/nvd
News mentions
0No linked articles in our index yet.