PT-2023-1262 · Qnap · Quts Hero+1

Huasheng_Mangguo · Publicado 2023-01-29 · Atualizado 2023-02-17 · CVE-2022-27596

Positive Technologies (AI Summary)

CVSS v2.0

10

Crítica

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions QuTS hero versions prior to h5.0.1.2248 build 20221215 QTS versions prior to 5.0.1.2234 build 20221201

Description A vulnerability has been reported to affect QNAP devices running QuTS hero and QTS, allowing remote attackers to inject malicious code. This issue is related to a SQL injection vulnerability. The vulnerability poses a threat to the confidentiality and integrity of the stored data. NAS devices are often targeted by ransomware due to the valuable data they store and their exposure to the Internet.

Recommendations For QuTS hero versions prior to h5.0.1.2248 build 20221215, update to version h5.0.1.2248 build 20221215 or later. For QTS versions prior to 5.0.1.2234 build 20221201, update to version 5.0.1.2234 build 20221201 or later.

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

BDU:2023-00525

CVE-2022-27596

Produtos afetados

Qts

Quts Hero

Referências · 14

• https://t.me/cibsecurity/57141 · Publicação no Telegram
• https://qnap.com/en/security-advisory/qsa-23-01 · Aviso do Fabricante
• https://t.me/pentestingnews/32658 · Publicação no Telegram
• https://t.me/cibsecurity/57398 · Publicação no Telegram
• https://t.me/true_secator/4004 · Publicação no Telegram
• https://t.me/cvenotify/43059 · Publicação no Telegram
• https://t.me/pentestingnews/32782 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2022-27596 · Nota de Segurança
• https://t.me/netlas/48 · Publicação no Telegram
• https://t.me/thehackernews/3005 · Publicação no Telegram
• https://bdu.fstec.ru/vul/2023-00525 · Nota de Segurança
• https://t.me/avleonovcom/1079 · Publicação no Telegram
• https://t.me/true_secator/4010 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2022-27596 · Aviso do Fabricante