← Back

CVE-2022-27597

nvd nist
Published: Mar 29, 2023Modified: Jun 17, 2026

JSON object

Loading...
2.7
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N
Exploitability: 1.2 / Impact: 1.4
Source: NVD

Description

A vulnerability has been reported to affect QNAP operating systems. If exploited, the out-of-bounds read vulnerability allows remote authenticated administrators to get secret values. The vulnerability affects the following QNAP operating systems: QTS, QuTS hero, QuTScloud, QVP (QVR Pro appliances) We have already fixed the vulnerability in the following versions: QTS 5.0.1.2346 build 20230322 and later QuTS hero h5.0.1.2348 build 20230324 and later

Affected (11)

Qnap
11 products
Qts
Quts Hero
Qutscloud
Qvr
Qvp 41b Firmware
Qvp 63b Firmware
Qvp 85b Firmware
Qvp 21a Firmware
Qvp 41a Firmware
Qvp 63a Firmware
Qvp 85a Firmware
Configuration A
4 vulnerable
Vulnerable SoftwareAffected Versions
Qts
Before 5.0.1.2346
Quts Hero
Before h5.0.1.2348
Qutscloud
All versions
Qvr
All versions
Configuration B
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Qvp 41b Firmware
All versions
Running on/withPlatform Versions
Qnap
Qvp 41b
All versions
Configuration C
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Qvp 63b Firmware
All versions
Running on/withPlatform Versions
Qnap
Qvp 63b
All versions
Configuration D
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Qvp 85b Firmware
All versions
Running on/withPlatform Versions
Qnap
Qvp 85b
All versions
Configuration E
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Qvp 21a Firmware
All versions
Running on/withPlatform Versions
Qnap
Qvp 21a
All versions
Configuration F
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Qvp 41a Firmware
All versions
Running on/withPlatform Versions
Qnap
Qvp 41a
All versions
Configuration G
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Qvp 63a Firmware
All versions
Running on/withPlatform Versions
Qnap
Qvp 63a
All versions
Configuration H
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Qvp 85a Firmware
All versions
Running on/withPlatform Versions
Qnap
Qvp 85a
All versions

Related CWEs

CWE-125
Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
CWE-1295
Debug Messages Revealing Unnecessary Information
The product fails to adequately prevent the revealing of unnecessary and potentially sensitive system information within debugging messages.
CWE-489
Active Debug Code
The product is deployed to unauthorized actors with debugging code still enabled or active, which can create unintended entry points or expose sensitive information.

References (2)

Source: security@qnapsecurity.com.tw
Vendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Vendor Advisory

Timeline

No history available yet.