Security News > 2023 > January > Critical QNAP NAS vulnerability fixed, update your device ASAP! (CVE-2022-27596)
QNAP Systems has fixed a critical vulnerability affecting QNAP network-attached storage devices, which could be exploited by remote attackers to inject malicious code into a vulnerable system.
Luckily for QNAP NAS owners, there's no mention of it being exploited by attackers or an exploit being publicly available.
QNAP's advisory does not offer more details about CVE-2022-27596, but the vulnerability entry in NIST's National Vulnerability Database reveals that the flaw may allow attackers to execute an SQL injection attack, due to "Improper neutralization of special elements used in an SQL command."
The vulnerability affects QNAP devices running version 5.0.1 of the QTS operating system for entry- and mid-level QNAP NAS devices and versions h5.0.1 of QuTS hero, the OS for high-end and enterprise QNAP NAS models.
QNAP NAS devices are often targeted by threat actors wielding different flavors of ransomware.
No workarounds for this flaw are available and QNAP advises users to update their appliances immediately.
News URL
https://www.helpnetsecurity.com/2023/01/31/cve-2022-27596/
Related news
- Apache fixes critical OFBiz remote code execution vulnerability (source)
- Apache OFBiz team patches critical RCE vulnerability (CVE-2024-45195) (source)
- Zyxel fixes critical command injection flaw in EOL NAS devices (CVE-2024-6342) (source)
- GitLab warns of critical pipeline execution vulnerability (source)
- SolarWinds Issues Patch for Critical ARM Vulnerability Enabling RCE Attacks (source)
- Critical Ivanti Cloud Appliance Vulnerability Exploited in Active Cyberattacks (source)
- CISA Flags Critical Ivanti vTM Vulnerability Amid Active Exploitation Concerns (source)
- PoC for critical SolarWinds Web Help Desk vulnerability released (CVE-2024-28987) (source)
- Critical NVIDIA Container Toolkit Vulnerability Could Grant Full Host Access to Attackers (source)
- Critical Zimbra RCE vulnerability under mass exploitation (CVE-2024-45519) (source)
Related Vulnerability
DATE | CVE | VULNERABILITY TITLE | RISK |
---|---|---|---|
2023-01-30 | CVE-2022-27596 | SQL Injection vulnerability in Qnap QTS and Quts Hero A vulnerability has been reported to affect QNAP device running QuTS hero, QTS. | 9.8 |