QNAP has released updates for its network-attached storage systems to address a critical security vulnerability that could allow remote attackers to inject malicious code. Customers of QNAP are being advised to update their QTS and QuTS hero firmware to fix the security flaw, which is tracked as CVE-2022-27596 and rated as Critical. It affects the QTS 5.0.1 and QuTS hero h5.0.1 versions of the operating system. The NIST National Vulnerability Database has identified the flaw as an SQL injection vulnerability, which can be exploited by remote attackers using low-complexity attacks without the involvement of users or privileges to the targeted device. To install the updates, users are encouraged to log in as an administrator to QTS or QuTS hero, navigate to Control Panel > System > Firmware Update, and choose Check for Update under the Live Update section. Alternatively, users can manually upgrade their devices by downloading the update from QNAPs Download Center after choosing the appropriate product type and model. It is important to install any available security upgrades as soon as possible, as threat actors regularly hunt for QNAP vulnerabilities.
This Cyber News was published on cybersecuritynews.com. Publication date: Wed, 01 Feb 2023 18:41:02 +0000