- 28/2023
- Critical
QNAP has released a security update to address a critical vulnerability across QNAP QTS and QNAP QuTS hero.
The severity of the addressed vulnerability could allow the remote unauthenticated attacker to inject and execute malicious code on the affected systems by sending specially crafted requests.
QNAP running QTS and running QTS code execution (CVE-2022-27596):
- CVSS: 9.8
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Consequences: Gain Access
Affected Products:
- QTS 5.0.1
- QuTS hero h5.0.1
Vulnerabilities
- CVE-2022-27596
Mitigations
The enterprise should deploy this patch as soon as the testing phase is completed.