QNAP is warning customers to install QTS and QuTS firmware updates that fix a critical security vulnerability that potentially allows remote attackers to inject malicious code on QNAP NAS devices. This vulnerability is tracked as CVE-2022-27596 and is rated as a Critical impact by the company and affects QTS 5.0.1 and QuTS hero h5.0.1 versions of the operating system.
The vulnerability, according to the company, is a SQL injection flaw, which allows attackers to send specially crafted requests to modify legitimate SQL queries to perform unexpected behavior. QNAP then released a JSON file that describes the severity of the vulnerability, indicating it can be exploited through low-level remote attacks, without requiring user interaction or privileges on the targeted device.
To update their devices, customers can log into the device and go to Control Panel System Firmware Update. Under the Live Update section, they should select the Check for Update option and wait for the download and installation to be finished. Furthermore, they can also manually download the updates from QNAP’s Download Center by selecting the correct product type and model.
QNAP’s advisory hasn’t marked CVE-2022-27596 as actively exploited in real-world attacks. However, considering the gravity of the vulnerability, users are advised to immediately apply available security updates to avoid exploitation.
QNAP devices are already being targeted by ongoing ransomware campaigns like DeadBolt and eCh0raix, which abuse vulnerabilities to encrypt data on exposed NAS devices.
This Cyber News was published on www.bleepingcomputer.com. Publication date: Mon, 30 Jan 2023 17:26:03 +0000