QNAP Systems has fixed a critical vulnerability affecting QNAP network-attached storage devices, which could be exploited by remote attackers to inject malicious code into a vulnerable system.
Luckily for QNAP NAS owners, there’s no mention of it being exploited by attackers or an exploit being publicly available.
QNAP’s advisory does not offer more details about CVE-2022-27596, but the vulnerability entry in NIST’s National Vulnerability Database reveals that the flaw may allow attackers to execute an SQL injection attack, due to “Improper neutralization of special elements used in an SQL command.”
The vulnerability affects QNAP devices running version 5.0.1 of the QTS operating system for entry- and mid-level QNAP NAS devices and versions h5.0.1 of QuTS hero, the OS for high-end and enterprise QNAP NAS models.
QNAP NAS devices are often targeted by threat actors wielding different flavors of ransomware.
No workarounds for this flaw are available and QNAP advises users to update their appliances immediately.
