Back
CVE-2023-30801
qBittorrent Web UI Default Credentials Lead to RCE
Critical9.8EPSS 1.2%
- Published
- Updated
- Reserved
- Assigned by
- VulnCheck
Description
All versions of the qBittorrent client through 4.5.5 use default credentials when the web user interface is enabled. The administrator is not forced to change the default credentials. As of 4.5.5, this issue has not been fixed. A remote attacker can use the default credentials to authenticate and execute arbitrary operating system commands using the "external program" feature in the web user interface. This was reportedly exploited in the wild in March 2023.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| VulnCheckCNA (assigner) | 3.1 | Critical9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| NVDNVD · Modified | 3.1 | Critical9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
- EPSS (exploitation in 30 days)
- 1.2% · top 31% of all CVEs (6 Nov 2026)
Loading the EPSS history…
The list uses the assigner's score when there is one, then CISA's, then NVD's: Critical 9.8.
Weakness
Affected products
qBittorrent · qBittorrent client
- affected ≤ 4.5.5
References (4)
- https://github.com/qbittorrent/qBittorrent/issues/18731 (opens in a new tab)issue-trackingx_transferred
- https://vulncheck.com/advisories/qbittorrent-default-creds (opens in a new tab)third-party-advisoryx_transferred
- https://lists.fedoraproject.org/archives/list/[email protected]/message/T5WXBKELVZFZNIDONIJESOCSRPIQNCGI/ (opens in a new tab)x_transferred
- https://lists.fedoraproject.org/archives/list/[email protected]/message/U4BNFJR3ZWVLE2YSYIQYBWVDQBBZOLEL/ (opens in a new tab)x_transferred
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://trackcve.app/cve/CVE-2023-30801)Record last updated .