Security News > 2023 > January > QNAP Fixes Critical Vulnerability in NAS Devices with Latest Security Updates
Taiwanese company QNAP has released updates to remediate a critical security flaw affecting its network-attached storage devices that could lead to arbitrary code injection.
Tracked as CVE-2022-27596, the vulnerability is rated 9.8 out of a maximum of 10 on the CVSS scoring scale.
"If exploited, this vulnerability allows remote attackers to inject malicious code," QNAP said in an advisory released Monday.
The exact technical specifics surrounding the flaw are unclear, but the NIST National Vulnerability Database has categorized it as an SQL injection vulnerability.
Zero-day vulnerabilities in exposed QNAP appliances have been put to use by DeadBolt ransomware actors to breach target networks, making it essential to update to the latest version in order to mitigate potential threats.
To apply the updates, users are advised to log in to QTS or QuTS hero as an administrator, navigate to Control Panel > System > Firmware Update, and select "Check for Update" under the "Live Update" section.
News URL
https://thehackernews.com/2023/01/qnap-fixes-critical-vulnerability-in.html
Related news
- Critical NVIDIA Container Toolkit Vulnerability Could Grant Full Host Access to Attackers (source)
- Critical Zimbra RCE vulnerability under mass exploitation (CVE-2024-45519) (source)
- Two simple give-me-control security bugs found in Optigo network switches used in critical manufacturing (source)
- Apple Releases Critical iOS and iPadOS Updates to Fix VoiceOver Password Vulnerability (source)
- Week in review: Critical Zimbra RCE vulnerability exploited, Patch Tuesday forecast (source)
- CISA Warns of Critical Fortinet Flaw as Palo Alto and Cisco Issue Urgent Security Patches (source)
- Experts Warn of Critical Unpatched Vulnerability in Linear eMerge E3 Systems (source)
- New Critical GitLab Vulnerability Could Allow Arbitrary CI/CD Pipeline Execution (source)
- Critical Veeam Vulnerability Exploited to Spread Akira and Fog Ransomware (source)
- Critical Kubernetes Image Builder Vulnerability Exposes Nodes to Root Access Risk (source)
Related Vulnerability
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2023-01-30 | CVE-2022-27596 | SQL Injection vulnerability in Qnap QTS and Quts Hero A vulnerability has been reported to affect QNAP device running QuTS hero, QTS. | 9.8 |