by Kastro
Paper/Archive/CVE-2022-27596

CVE-2022-27596

QNAP Systems Inc. QuTS hero — Vulnerability in QTS

EPSS 3%CVSS 9.8
critical.is priorityof 100
47
CVSS 9.8 (NVD, CNA agree)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 85.7.857 × 2017.1No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

A vulnerability has been reported to affect QNAP device running QuTS hero, QTS. If exploited, this vulnerability allows remote attackers to inject malicious code. We have already fixed this vulnerability in the following versions of QuTS hero, QTS: QuTS hero h5.0.1.2248 build 20221215 and later QTS 5.0.1.2234 build 20221201 and later

Affected

ProductAffectedFixed inSource
QuTS heroh5.0.1 – < h5.0.1.2248 build 20221215h5.0.1.2248 build 20221215CNA
QTS5.0.1 – < 5.0.1.2234 build 202212015.0.1.2234 build 20221201CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
qnap (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refqnap.com/en/security-advisory/qsa-23-01