CVE-2022-27596: Vulnerability in QTS

Q: Which devices are affected by CVE-2022-27596?

QNAP devices running QuTS hero and QTS versions between 5.0.1 and 5.0.1.2234, and QuTS hero versions between h5.0.1 and h5.0.1.2248 are affected.

Q: What is the severity of CVE-2022-27596?

The severity of CVE-2022-27596 is critical with a CVSS score of 9.8.

Q: How can CVE-2022-27596 be exploited?

CVE-2022-27596 can be exploited by remote attackers to inject malicious code.

Q: Has CVE-2022-27596 been fixed?

Yes, CVE-2022-27596 has been fixed in QuTS hero h5.0.1.2248 build 20221215 and later, and in QTS.

Q: Where can I find more information about CVE-2022-27596?

You can find more information about CVE-2022-27596 at https://www.qnap.com/en/security-advisory/qsa-23-01.

Published Jan 30, 2023

Updated

A vulnerability has been reported to affect QNAP device running QuTS hero, QTS. If exploited, this vulnerability allows remote attackers to inject malicious code. We have already fixed this vulnerability in the following versions of QuTS hero, QTS: QuTS hero h5.0.1.2248 build 20221215 and later QTS 5.0.1.2234 build 20221201 and later

Affected Software

2 affected components

QNAP QTS>=5.0.1<5.0.1.2234

QNAP QuTS hero>=h5.0.1<h5.0.1.2248

Remediation

Information

We have already fixed this vulnerability in the following versions of QuTS hero, QTS: QuTS hero h5.0.1.2248 build 20221215 and later QTS 5.0.1.2234 build 20221201 and later

Event History

Jan 30, 2023

CVE Published

via MITRE·01:13 AM

Data Sourced

via MITRE·01:13 AM

RemedyDescriptionSeverityWeakness

Frequently Asked Questions

Which devices are affected by CVE-2022-27596?

QNAP devices running QuTS hero and QTS versions between 5.0.1 and 5.0.1.2234, and QuTS hero versions between h5.0.1 and h5.0.1.2248 are affected.

What is the severity of CVE-2022-27596?