PT-2023-1262 · Qnap · Quts Hero+1

Huasheng_Mangguo · Published 2023-01-29 · Updated 2023-02-17 · CVE-2022-27596

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions QuTS hero versions prior to h5.0.1.2248 build 20221215 QTS versions prior to 5.0.1.2234 build 20221201

Description A vulnerability has been reported to affect QNAP devices running QuTS hero and QTS, allowing remote attackers to inject malicious code. This issue is related to a SQL injection vulnerability. The vulnerability poses a threat to the confidentiality and integrity of the stored data. NAS devices are often targeted by ransomware due to the valuable data they store and their exposure to the Internet.

Recommendations For QuTS hero versions prior to h5.0.1.2248 build 20221215, update to version h5.0.1.2248 build 20221215 or later. For QTS versions prior to 5.0.1.2234 build 20221201, update to version 5.0.1.2234 build 20221201 or later.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

BDU:2023-00525

CVE-2022-27596

Affected Products

Qts

Quts Hero

References · 14

• https://qnap.com/en/security-advisory/qsa-23-01 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-27596 · Security Note
• https://bdu.fstec.ru/vul/2023-00525 · Security Note
• https://osv.dev/vulnerability/CVE-2022-27596 · Vendor Advisory
• https://t.me/cibsecurity/57141 · Telegram Post
• https://t.me/pentestingnews/32658 · Telegram Post
• https://t.me/cibsecurity/57398 · Telegram Post
• https://t.me/true_secator/4004 · Telegram Post
• https://t.me/cvenotify/43059 · Telegram Post
• https://t.me/pentestingnews/32782 · Telegram Post
• https://t.me/netlas/48 · Telegram Post
• https://t.me/thehackernews/3005 · Telegram Post
• https://t.me/avleonovcom/1079 · Telegram Post
• https://t.me/true_secator/4010 · Telegram Post