CVE-2022-27596 Vulnerability in QTS
Remote attackers can inject malicious code into QNAP NAS devices running QTS or QuTS hero, potentially leading to full system compromise.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2022-27596?
CVE-2022-27596 is a critical SQL injection vulnerability in Qnap Qts, published on 30 Jan 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A vulnerability has been reported to affect QNAP device running QuTS hero, QTS. If exploited, this vulnerability allows remote attackers to inject malicious code. We have already fixed this vulnerability in the following versions of QuTS hero, QTS: QuTS hero h5.0.1.2248 build 20221215 and later QTS 5.0.1.2234 build 20221201 and later
Weakness: CWE-89
Which versions are affected by CVE-2022-27596?
It affects 2 products.
Products include Qnap Qts, Qnap Quts Hero.
How do I fix CVE-2022-27596?
No fix has been published for CVE-2022-27596 yet. Limit exposure of the affected software until one is available.
Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.
Is CVE-2022-27596 being exploited?
There is no known exploitation of CVE-2022-27596 in the wild and no public exploit code.
Other vulnerabilities in Qnap Qts
Sources
Also known as GHSA-xj35-32mv-jpmp.