QNAP fixes critical bug letting hackers inject malicious code

guest · Jan 31, 2023

By Bill Toulas @billtoulas - January 30, 2023

QNAP is warning customers to install QTS and QuTS firmware updates that fix a critical security vulnerability allowing remote attackers to inject malicious code on QNAP NAS devices.
Click to expand...

The vulnerability is tracked as CVE-2022-27596 and rated by the company as 'Critical' (CVSS v3 score: 9.8), impacting QTS 5.0.1 and QuTS hero h5.0.1 versions of the operating system.

"A vulnerability has been reported to affect QNAP devices running QTS 5.0.1 and QuTS hero h5.0.1. If exploited, this vulnerability allows remote attackers to inject malicious code,' warns the QNAP security advisory.
The vendor hasn't disclosed many details about the vulnerability or its exploitation potential, but the NIST portal describes it as a SQL injection flaw.
Click to expand...

SQL injection flaws allow attackers to send specially crafted requests on vulnerable devices to modify legitimate SQL queries to perform unexpected behavior.

However, due to the flaw's severity, users are recommended to apply available security updates as soon as possible, as threat actors actively target QNAP vulnerabilities.
Click to expand...

guest · Feb 1, 2023

Over 29,000 QNAP devices unpatched against new critical flaw
By Sergiu Gatlan @serghei - January 31, 2023

Tens of thousands of QNAP network-attached storage (NAS) devices are waiting to be patched against a critical security flaw addressed by the Taiwanese company on Monday.
Click to expand...

Remote threat actors can exploit this SQL injection vulnerability (CVE-2022-27596) to inject malicious code in attacks targeting Internet-exposed and unpatched QNAP devices.

QNAP also assigned this bug a CVSS base score of 9.8/10 and said it could be abused in low-complexity attacks by unauthenticated malicious actors without requiring user interaction.
Click to expand...

Tens of thousands of unpatched devices exposed to attacks
One day after QNAP released security updates to address this critical vulnerability, Censys security researchers published a report revealing that just over 550 out of more than 60,000 QNAP NAS devices they found online were patched.

"Censys has observed 67,415 hosts with indications of running a QNAP-based system; unfortunately, we could only obtain the version number from 30,520 hosts. But, if the advisory is correct, over 98% of identified QNAP devices would be vulnerable to this attack," senior security researcher Mark Ellzey said.
Luckily, since this flaw is not yet abused in the wild and proof-of-concept exploit code hasn't yet surfaced online, there's yet time to patch these vulnerable NAS devices and secure them from attacks.
Click to expand...

Log in or Sign up

QNAP fixes critical bug letting hackers inject malicious code

guest Guest

guest Guest

Log in or Sign up

QNAP fixes critical bug letting hackers inject malicious code

guest Guest

guest Guest

Useful Searches