Project Hyphae
Search

Oh Snap! QNAP

Share This Post

CVE-2022-27596

Thousands of QNAP network-attached storage (NAS) devices have a critical security flaw that needs to be patched.

QNAP has stated that the vulnerability affects QNAP devices running QTS 5.0.1 and QuTS hero h5.0.1.
If exploited, this vulnerability allows remote attackers to inject malicious code.

QNAP claims to have already fixed this vulnerability in the following operating system versions:

  • QTS 5.0.1.2234 build 20221201 and later
  • QuTS hero h5.0.1.2248 build 20221215 and later

If exploited, the vulnerability would allow remote actors to inject malicious code into Internet-exposed, unpatched QNAP devices through a SQL injection vulnerability.

It is important for QNAP customers to patch their NAS devices before threat actors can exploit the vulnerability, as NAS devices have been targeted by multiple ransomware strains in recent years.

In addition to updating, customers should also consider not exposing their devices online to prevent remote exploitation, and if a device needs to be accessible online, make sure to harden and limit access to the device as much as possible. FRSecure recommends that for remote access to such devices, securing them behind a VPN, and utilizing modern authentication methods, unique credentials and MFA, is best.



Reach out to our incident response team for help

More To Explore

Information Security News 3-25-2024

Developer Sues Minnesota Contractor After $735K Payment Disappears Article Link: https://www.constructiondive.com/news/beck-sues-ryan-fsa-title-cybercrime/710708/ Truck-to-Truck Worm Could Infect and Disrupt Entire US Commercial Fleet Article Link: https://www.theregister.com/2024/03/22/boffins_tucktotruck_worm/ NIST’s

Information Security News 3-18-2024

Threat Actors Leaked 70 Million Records Allegedly Stolen From AT&T Article Link: https://securityaffairs.com/160627/data-breach/70m-att-records-leaked.html Former Telecom Manager Admits to Doing SIM Swaps for $1,000 Article Link:

Do You Want to Shore Up Your Defenses?

We're opening our first round of threat hunting engagements to 100 organizations. Sign up or join the wait list here.