CVE-2022-27598

Published: Mar 29, 2023Modified: Jun 17, 2026

2.7

Vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

Exploitability: 1.2 / Impact: 1.4

Source: NVD

Description

A vulnerability has been reported to affect QNAP operating systems. If exploited, the out-of-bounds read vulnerability allows remote authenticated administrators to get secret values. The vulnerability affects the following QNAP operating systems: QTS, QuTS hero, QuTScloud, QVP (QVR Pro appliances) We have already fixed the vulnerability in the following versions: QTS 5.0.1.2346 build 20230322 and later QuTS hero h5.0.1.2348 build 20230324 and later

Affected (10)

Products: Qnap: Qts, Quts Hero, Qutscloud, Qvp 41b Firmware, Qvp 63b Firmware, Qvp 85b Firmware, Qvp 21a Firmware, Qvp 41a Firmware, Qvp 63a Firmware, Qvp 85a Firmware

10 products

Configuration A

3 vulnerable

Vulnerable Software	Affected Versions
Qnap Qts	Before 5.0.1.2346
Qnap Quts Hero	Before h5.0.1.2348
Qnap Qutscloud	All versions

Configuration B

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Qnap Qvp 41b Firmware	All versions

Running on/with	Platform Versions
Qnap Qvp 41b	All versions

Configuration C

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Qnap Qvp 63b Firmware	All versions

Running on/with	Platform Versions
Qnap Qvp 63b	All versions

Configuration D

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Qnap Qvp 85b Firmware	All versions

Running on/with	Platform Versions
Qnap Qvp 85b	All versions

Configuration E

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Qnap Qvp 21a Firmware	All versions

Running on/with	Platform Versions
Qnap Qvp 21a	All versions

Configuration F

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Qnap Qvp 41a Firmware	All versions

Running on/with	Platform Versions
Qnap Qvp 41a	All versions

Configuration G

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Qnap Qvp 63a Firmware	All versions

Running on/with	Platform Versions
Qnap Qvp 63a	All versions

Configuration H

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Qnap Qvp 85a Firmware	All versions

Running on/with	Platform Versions
Qnap Qvp 85a	All versions

Related CWEs

CWE-125

Out-of-bounds Read

The product reads data past the end, or before the beginning, of the intended buffer.

References (2)

https://www.qnap.com/en/security-advisory/qsa-23-06

Source: security@qnapsecurity.com.tw

Vendor Advisory

https://www.qnap.com/en/security-advisory/qsa-23-06

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.