CVE-2022-27598

LowCVSS 2.7/10Last modified Jun 17, 2026

Description

A vulnerability has been reported to affect QNAP operating systems. If exploited, the out-of-bounds read vulnerability allows remote authenticated administrators to get secret values. The vulnerability affects the following QNAP operating systems: QTS, QuTS hero, QuTScloud, QVP (QVR Pro appliances) We have already fixed the vulnerability in the following versions: QTS 5.0.1.2346 build 20230322 and later QuTS hero h5.0.1.2348 build 20230324 and later

Metrics

CVSS 3.1 2.7/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-125

Affected software

Vendor	Product	Versions
QNAP Systems Inc.	QTS	>= unspecified, < 5.0.1.2346 build 20230322
QNAP Systems Inc.	QuTS hero	>= unspecified, < h5.0.1.2348 build 20230324

References

https://www.qnap.com/en/security-advisory/qsa-23-06Vendor Advisory
https://www.qnap.com/en/security-advisory/qsa-23-06Vendor Advisory

Timeline

Published: Mar 29, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-275994.4An insertion of sensitive information into Log file vulnerability has been reported to affect product. If exploited, the vulnerability possi CVE-2022-27604.3In affected versions of Octopus Deploy it is possible to reveal the Space ID of spaces that the user does not have access to view in an erro CVE-2022-276007.5An uncontrolled resource consumption vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vul CVE-2022-276078.1Bento4 1.6.0-639 has a heap-based buffer over-read in the AP4_HvccAtom class, a different issue than CVE-2018-14531.CVE-2022-276086.0Forcepoint One Endpoint prior to version 22.01 installed on Microsoft Windows is vulnerable to registry key tampering by users with Administ CVE-2022-276096.0Forcepoint One Endpoint prior to version 22.01 installed on Microsoft Windows does not provide sufficient anti-tampering protection of servi CVE-2022-27615.3An information disclosure issue in GitLab CE/EE affecting all versions from 14.4 prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 prior to 15 CVE-2022-276108.1Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in webapi component in Synology DiskStation Man CVE-2022-276118.1Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in webapi component in Synology Audio Station b CVE-2022-276129.8Buffer copy without checking size of input ('Classic Buffer Overflow') vulnerability in cgi component in Synology Audio Station before 6.5.4 CVE-2022-276138.8Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in webapi component in Synology CardDAV S CVE-2022-276147.5Exposure of sensitive information to an unauthorized actor vulnerability in web server in Synology Media Server before 1.8.1-2876 allows rem