CVE-2022-27596

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A vulnerability has been reported to affect QNAP device running QuTS hero, QTS. If exploited, this vulnerability allows remote attackers to inject malicious code. We have already fixed this vulnerability in the following versions of QuTS hero, QTS: QuTS hero h5.0.1.2248 build 20221215 and later QTS 5.0.1.2234 build 20221201 and later

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

Vendor	Product	Versions
QNAP Systems Inc.	QuTS hero	>= h5.0.1, < h5.0.1.2248 build 20221215
QNAP Systems Inc.	QTS	>= 5.0.1, < 5.0.1.2234 build 20221201

References

https://www.qnap.com/en/security-advisory/qsa-23-01Vendor Advisory
https://www.qnap.com/en/security-advisory/qsa-23-01Vendor Advisory

Timeline

Published: Jan 30, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-275972.7A vulnerability has been reported to affect QNAP operating systems. If exploited, the out-of-bounds read vulnerability allows remote authent CVE-2022-275982.7A vulnerability has been reported to affect QNAP operating systems. If exploited, the out-of-bounds read vulnerability allows remote authent CVE-2022-275994.4An insertion of sensitive information into Log file vulnerability has been reported to affect product. If exploited, the vulnerability possi CVE-2022-27604.3In affected versions of Octopus Deploy it is possible to reveal the Space ID of spaces that the user does not have access to view in an erro CVE-2022-276007.5An uncontrolled resource consumption vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vul CVE-2022-276078.1Bento4 1.6.0-639 has a heap-based buffer over-read in the AP4_HvccAtom class, a different issue than CVE-2018-14531.CVE-2022-276086.0Forcepoint One Endpoint prior to version 22.01 installed on Microsoft Windows is vulnerable to registry key tampering by users with Administ CVE-2022-276096.0Forcepoint One Endpoint prior to version 22.01 installed on Microsoft Windows does not provide sufficient anti-tampering protection of servi CVE-2022-27615.3An information disclosure issue in GitLab CE/EE affecting all versions from 14.4 prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 prior to 15 CVE-2022-276108.1Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in webapi component in Synology DiskStation Man CVE-2022-276118.1Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in webapi component in Synology Audio Station b CVE-2022-276129.8Buffer copy without checking size of input ('Classic Buffer Overflow') vulnerability in cgi component in Synology Audio Station before 6.5.4