{"vulnerability": "CVE-2022-27596", "sightings": [{"uuid": "16feb8a5-02e8-4640-a88d-8694ee92be52", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-27596", "type": "seen", "source": "https://t.me/ctinow/90842", "content": "Over 30k Internet-Exposed QNAP NAS hosts impacted by CVE-2022-27596 flaw\n\nhttps://ift.tt/hVrJkv3", "creation_timestamp": "2023-02-02T07:46:37.000000Z"}, {"uuid": "d55760c1-55a7-4126-85bf-3eae897faf2d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-27596", "type": "seen", "source": "https://t.me/ctinow/90388", "content": "Critical QNAP NAS vulnerability fixed, update your device ASAP! (CVE-2022-27596)\n\nhttps://ift.tt/O8q6lrs", "creation_timestamp": "2023-01-31T18:56:44.000000Z"}, {"uuid": "5856fcda-12e8-49a7-af9a-278f16ed8e27", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-27596", "type": "seen", "source": "https://t.me/true_secator/4010", "content": "\u0412 \u043a\u043e\u043d\u0442\u0435\u043a\u0441\u0442\u0435 \u043d\u0435\u0434\u0430\u0432\u043d\u0435\u0433\u043e \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0442\u0430\u0439\u0432\u0430\u043d\u044c\u0441\u043a\u0438\u043c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u0435\u043c QNAP \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0439 SQL-\u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 (CVE-2022-27596) \u0441 \u043e\u0446\u0435\u043d\u043a\u043e\u0439 CVSS 9,8 \u043d\u0430\u0441 \u0442\u0443\u0442 \u0441\u043f\u0440\u0430\u0432\u0435\u0434\u043b\u0438\u0432\u043e \u0441\u043f\u0440\u0430\u0448\u0438\u0432\u0430\u044e\u0442 \u0447\u0438\u0442\u0430\u0442\u0435\u043b\u0438: \u043d\u0443 \u043a\u0430\u043a\u043e\u0439 \u043a\u0440\u0435\u0442\u0438\u043d \u0432\u044b\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 NAS \u0432 \u0418\u043d\u0442\u0435\u0440\u043d\u0435\u0442?\n\n\u041d\u043e \u043e\u0442\u0432\u0435\u0442 \u0432\u0440\u044f\u0434 \u043b\u0438 \u043f\u043e\u0440\u0430\u0434\u0443\u0435\u0442: 67 415 NAS-\u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432 QNAP \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u043b\u0438 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 Censys, \u043f\u0440\u0438\u0447\u0435\u043c \u0438\u0437 \u043f\u0440\u043e\u0430\u043d\u0430\u043b\u0438\u0437\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0445 30 520 \u0445\u043e\u0441\u0442\u043e\u0432 \u0431\u043e\u043b\u0435\u0435 98% \u043e\u0441\u0442\u0430\u044e\u0442\u0441\u044f \u043d\u0435\u043f\u0440\u043e\u043f\u0430\u0442\u0447\u0435\u043d\u043d\u044b\u043c\u0438 \u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u044b\u043c\u0438 \u0434\u043b\u044f \u0430\u0442\u0430\u043a \u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c CVE-2022-27596.\n\n\u041a\u0430\u043a \u043c\u044b \u0443\u0436\u0435 \u043e\u0442\u043c\u0435\u0447\u0430\u043b\u0438, \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u044b\u0435 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438, \u043d\u0435 \u043f\u0440\u043e\u0448\u0435\u0434\u0448\u0438\u0445 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0443 \u043f\u043e\u0434\u043b\u0438\u043d\u043d\u043e\u0441\u0442\u0438, \u043c\u043e\u0433\u0443\u0442 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u044d\u0442\u0443 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0434\u043b\u044f \u0432\u043d\u0435\u0434\u0440\u0435\u043d\u0438\u044f \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0433\u043e \u043a\u043e\u0434\u0430 \u0432 \u0430\u0442\u0430\u043a\u0430\u0445 \u043d\u0438\u0437\u043a\u043e\u0439 \u0441\u043b\u043e\u0436\u043d\u043e\u0441\u0442\u0438, \u0431\u0435\u0437 \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u043e\u0441\u0442\u0438 \u0432\u0437\u0430\u0438\u043c\u043e\u0434\u0435\u0439\u0441\u0442\u0432\u0438\u044f \u0441 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u043c.\n\n\u041a \u0441\u0447\u0430\u0441\u0442\u044c\u044e, \u043f\u043e\u0441\u043a\u043e\u043b\u044c\u043a\u0443 \u044d\u0442\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0435\u0449\u0435 \u043d\u0435 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442\u0441\u044f \u0432 \u0434\u0438\u043a\u043e\u0439 \u043f\u0440\u0438\u0440\u043e\u0434\u0435, \u0430 PoC \u0435\u0449\u0435 \u043d\u0435 \u043f\u043e\u044f\u0432\u0438\u043b\u0441\u044f \u0432 \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u043c \u0434\u043e\u0441\u0442\u0443\u043f\u0435, \u0443 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0435\u0449\u0435 \u0435\u0441\u0442\u044c \u0432\u0440\u0435\u043c\u044f, \u0447\u0442\u043e\u0431\u044b \u0438\u0441\u043f\u0440\u0430\u0432\u0438\u0442\u044c \u0443\u044f\u0437\u0432\u0438\u043c\u044b\u0435 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430 NAS.\n\n\u0412\u0430\u043d\u0433\u0443\u0435\u043c, \u0447\u0442\u043e \u043f\u0435\u0440\u0432\u044b\u0435 \u0436\u0435\u0440\u0442\u0432\u044b \u0430\u0442\u0430\u043a \u043f\u043e\u044f\u0432\u044f\u0442\u0441\u044f \u0435\u0449\u0435 \u0434\u043e \u0432\u044b\u0445\u043e\u0434\u0430 PoC-\u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u0430, \u043f\u043e \u043a\u0440\u0430\u0439\u043d\u0435\u0439 \u043c\u0435\u0440\u0435 DeadBolt \u0438 eCh0raix \u0443\u0436\u0435 \u043d\u0435 \u0440\u0430\u0437 \u044d\u0442\u043e \u0434\u0435\u043c\u043e\u043d\u0441\u0442\u0440\u0438\u0440\u043e\u0432\u0430\u043b\u0438.\n\n\u041f\u043e\u043c\u0438\u043c\u043e \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u044c NAS \u043f\u0440\u0438\u0437\u044b\u0432\u0430\u0435\u0442 \u043a\u043b\u0438\u0435\u043d\u0442\u043e\u0432 \u0441 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430\u043c\u0438, \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u043d\u044b\u043c\u0438 \u043a \u0418\u043d\u0442\u0435\u0440\u043d\u0435\u0442\u0443, \u043f\u0440\u0438\u043d\u044f\u0442\u044c \u043c\u0435\u0440\u044b \u0434\u043b\u044f \u0437\u0430\u0449\u0438\u0442\u044b \u0438\u0445 \u043e\u0442 \u0432\u0445\u043e\u0434\u044f\u0449\u0438\u0445 \u0430\u0442\u0430\u043a, \u043e\u0442\u043a\u043b\u044e\u0447\u0438\u0432 \u0444\u0443\u043d\u043a\u0446\u0438\u0438 \u043f\u0435\u0440\u0435\u0430\u0434\u0440\u0435\u0441\u0430\u0446\u0438\u0438 \u043f\u043e\u0440\u0442\u043e\u0432 \u043c\u0430\u0440\u0448\u0440\u0443\u0442\u0438\u0437\u0430\u0442\u043e\u0440\u0430 \u0438 UPnP QNAP NAS.\n\n\u041a\u0440\u043e\u043c\u0435 \u0442\u043e\u0433\u043e, \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0443\u0435\u0442\u0441\u044f \u0442\u0430\u043a\u0436\u0435 \u043e\u0442\u043a\u043b\u044e\u0447\u0438\u0442\u044c \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u044f SSH \u0438 Telnet, \u0438\u0437\u043c\u0435\u043d\u0438\u0442\u044c \u043d\u043e\u043c\u0435\u0440 \u0441\u0438\u0441\u0442\u0435\u043c\u043d\u043e\u0433\u043e \u043f\u043e\u0440\u0442\u0430, \u043f\u0430\u0440\u043e\u043b\u0438 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432 \u0438 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u044c \u0437\u0430\u0449\u0438\u0442\u0443 \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a IP-\u0430\u0434\u0440\u0435\u0441\u0443 \u0438 \u0443\u0447\u0435\u0442\u043d\u043e\u0439 \u0437\u0430\u043f\u0438\u0441\u0438, \u0441\u043b\u0435\u0434\u0443\u044f \u044d\u0442\u0438\u043c \u0438\u043d\u0441\u0442\u0440\u0443\u043a\u0446\u0438\u044f\u043c.", "creation_timestamp": "2023-02-01T11:31:35.000000Z"}, {"uuid": "bd872345-bc32-47eb-860c-ff101ea922ab", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-27596", "type": "seen", "source": "https://t.me/true_secator/4004", "content": "\u0412 \u043d\u0430\u0447\u0430\u043b\u0435 \u043f\u0440\u043e\u0448\u043b\u043e\u0433\u043e \u0433\u043e\u0434\u0430 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u044c QNAP \u043c\u043e\u0436\u043d\u043e \u0441\u043a\u0430\u0437\u0430\u0442\u044c \u0434\u0432\u0430\u0436\u0434\u044b \u043a\u0438\u043d\u0443\u043b \u0441\u0432\u043e\u0438\u0445 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439, \u0431\u0443\u043a\u0432\u0430\u043b\u044c\u043d\u043e - \u0432 \u0440\u0443\u043a\u0438 \u0432\u044b\u043c\u043e\u0433\u0430\u0442\u0435\u043b\u0435\u0439 DeadBolt \u0438 eCh0raix, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043b\u0438 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430 NAS \u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c 0-day, \u043f\u043e\u043a\u0430 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u044c \u0431\u0443\u043a\u0441\u043e\u0432\u0430\u043b \u0441 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435\u043c.\n\n\u0420\u0435\u0448\u0438\u0432 \u0432\u0441\u0435 \u0436\u0435 \u0432 \u043d\u043e\u0432\u043e\u043c \u0433\u043e\u0434\u0443 \u043d\u0435 \u043d\u0430\u0441\u0442\u0443\u043f\u0430\u0442\u044c \u043d\u0430 \u0442\u0435 \u0436\u0435 \u0433\u0440\u0430\u0431\u043b\u0438, QNAP \u0440\u0435\u0448\u0438\u043b\u0430 \u043e\u043f\u0435\u0440\u0435\u0434\u0438\u0442\u044c \u043e\u0447\u0435\u0440\u0435\u0434\u043d\u0443\u044e \u0432\u043e\u043b\u043d\u0443 ransomware, \u043f\u0440\u0438\u0437\u044b\u0432\u0430\u0432 \u043a\u043b\u0438\u0435\u043d\u0442\u043e\u0432 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u0438\u0442\u044c \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f \u0434\u043b\u044f QTS \u0438 QuTS, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0443\u0441\u0442\u0440\u0430\u043d\u044f\u044e\u0442 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0443\u044e RCE-\u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c.\n\nCVE-2022-27596 \u043e\u0446\u0435\u043d\u0438\u0432\u0430\u0435\u0442\u0441\u044f \u043a\u0430\u043a \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u0441 \u043e\u0446\u0435\u043d\u043a\u043e\u0439 CVSS v3: 9,8 \u0438 \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 \u0432\u0435\u0440\u0441\u0438\u0438 \u041e\u0421 QTS 5.0.1 \u0438 QuTS hero h5.0.1, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044f \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u044b\u043c \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c \u0432\u043d\u0435\u0434\u0440\u044f\u0442\u044c \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0439 \u043a\u043e\u0434 \u0432 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430 QNAP NAS.\n\n\u041f\u043e\u0441\u0442\u0430\u0432\u0449\u0438\u043a \u043d\u0435 \u0440\u0430\u0441\u043a\u0440\u044b\u043b \u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u0438\u0445 \u043f\u043e\u0434\u0440\u043e\u0431\u043d\u043e\u0441\u0442\u0435\u0439 \u0438\u043b\u0438 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438 \u043e \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044f\u0445 \u0435\u0435 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438, \u043d\u043e\u00a0\u0441\u043e\u0433\u043b\u0430\u0441\u043d\u043e NIST, \u043e\u0448\u0438\u0431\u043a\u0430 \u043e\u043f\u0438\u0441\u044b\u0432\u0430\u0435\u0442\u0441\u044f \u043a\u0430\u043a \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c SQL-\u0438\u043d\u044a\u0435\u043a\u0446\u0438\u0438.\n\n\u041a\u0440\u043e\u043c\u0435 \u0442\u043e\u0433\u043e, QNAP \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u0438\u043b\u0430 JSON, \u0434\u0435\u043c\u043e\u043d\u0441\u0442\u0440\u0438\u0440\u0443\u044e\u0449\u0438\u0439 \u0441\u0435\u0440\u044c\u0435\u0437\u043d\u043e\u0441\u0442\u044c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u0443\u043a\u0430\u0437\u044b\u0432\u0430\u044f \u043d\u0430 \u0442\u043e, \u0447\u0442\u043e \u0435\u0435 \u043c\u043e\u0436\u043d\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u0432 \u0430\u0442\u0430\u043a\u0430\u0445 \u043d\u0438\u0437\u043a\u043e\u0439 \u0441\u043b\u043e\u0436\u043d\u043e\u0441\u0442\u0438 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u044b\u043c\u0438 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c\u0438, \u043d\u0435 \u0442\u0440\u0435\u0431\u0443\u044e\u0449\u0438\u043c\u0438 \u0432\u043c\u0435\u0448\u0430\u0442\u0435\u043b\u044c\u0441\u0442\u0432\u0430 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f \u0438\u043b\u0438 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439 \u043d\u0430 \u0446\u0435\u043b\u0435\u0432\u043e\u043c \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0435.\n\n\u0412 \u0431\u044e\u043b\u043b\u0435\u0442\u0435\u043d\u0435 QNAP \u043d\u0435 \u043e\u0442\u043c\u0435\u0442\u0438\u043b\u0430 CVE-2022-27596 \u043a\u0430\u043a \u0430\u043a\u0442\u0438\u0432\u043d\u043e \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u0435\u043c\u0443\u044e \u0432 \u0434\u0438\u043a\u043e\u0439 \u043f\u0440\u0438\u0440\u043e\u0434\u0435.\n\n\u0412 \u0441\u0438\u043b\u0443 \u0435\u0435 \u0441\u0435\u0440\u044c\u0435\u0437\u043d\u043e\u0441\u0442\u0438 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f\u043c \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0443\u0435\u0442\u0441\u044f \u043a\u0430\u043a \u043c\u043e\u0436\u043d\u043e \u0441\u043a\u043e\u0440\u0435\u0435 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u0438\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u044b\u0435 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f: QTS 5.0.1.2234 \u0441\u0431\u043e\u0440\u043a\u0430 20221201 \u0438 QuTS hero h5.0.1.2248 \u0441\u0431\u043e\u0440\u043a\u0438 20221215 (\u0438\u043b\u0438 \u0431\u043e\u043b\u0435\u0435 \u043f\u043e\u0437\u0434\u043d\u0438\u0435).\n\n\u041d\u043e, \u043f\u043e \u0432\u0441\u0435\u0439 \u0432\u0438\u0434\u0438\u043c\u043e\u0441\u0442\u0438, \u00ab\u043d\u0430\u0442\u0440\u0435\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u043c\u00bb \u0435\u0449\u0435 \u0441 \u043f\u0440\u043e\u0448\u043b\u043e\u0433\u043e \u0433\u043e\u0434\u0430 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f\u043c QNAP NAS \u043d\u0430\u043f\u043e\u043c\u0438\u043d\u0430\u043d\u0438\u044f \u0432 \u043f\u0440\u0438\u043d\u0446\u0438\u043f\u0435 \u043d\u0435 \u0442\u0440\u0435\u0431\u0443\u044e\u0442\u0441\u044f.", "creation_timestamp": "2023-01-31T11:05:10.000000Z"}, {"uuid": "fad19c25-81ce-4637-b02f-1c31da4b857e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-27596", "type": "seen", "source": "https://t.me/cibsecurity/57398", "content": "\ud83d\udd74 Patch Critical Bug Now: QNAP NAS Devices Ripe for the Slaughter \ud83d\udd74\n\nAnalysts find that 98% of QNAP NAS are vulnerable to CVE-2022-27596, which allows unauthenticated, remote SQL code injection.\n\n\ud83d\udcd6 Read\n\nvia \"Dark Reading\".", "creation_timestamp": "2023-02-02T17:20:47.000000Z"}, {"uuid": "8ed0e9b6-b165-464d-b6b8-8d5aad5e84f8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-27596", "type": "seen", "source": "https://t.me/cibsecurity/57141", "content": "\u203c CVE-2022-27596 \u203c\n\nA vulnerability has been reported to affect QNAP device running QuTS hero, QTS. If exploited, this vulnerability allows remote attackers to inject malicious code. We have already fixed this vulnerability in the following versions of QuTS hero, QTS: QuTS hero h5.0.1.2248 build 20221215 and later QTS 5.0.1.2234 build 20221201 and later\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2023-01-30T07:36:52.000000Z"}, {"uuid": "a0da9023-3702-4e69-b5f8-ce9bf350b6f5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-27596", "type": "seen", "source": "https://t.me/thehackernews/3005", "content": "Don't risk losing your data!\n\nQNAP has released security updates to address a critical vulnerability (CVE-2022-27596 / CVSS 9.8) in the NAS devices QTS 5.0.1 & QuTS hero h5.0.1 that can be used to inject arbitrary code.\n\nRead: https://thehackernews.com/2023/01/qnap-fixes-critical-vulnerability-in.html", "creation_timestamp": "2023-01-31T05:13:36.000000Z"}, {"uuid": "2d0dd645-14c7-4b91-a32a-098fb9e2f829", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-27596", "type": "seen", "source": "https://t.me/cissp/6573", "content": "Don't risk losing your data!\nQNAP has released security updates to address a critical vulnerability (CVE-2022-27596 / CVSS 9.8) in the NAS devices QTS 5.0.1 & QuTS hero h5.0.1 that can be used to inject arbitrary code.\nRead: https://thehackernews.com/2023/01/qnap-fixes-critical-vulnerability-in.html\n\n\n-Cyber Security awareness-\n\nUp2date 4 Defence Today,\nSecure Tomorrow\n@CisoasaService\n1401.11.10", "creation_timestamp": "2026-09-01T17:00:22.501568Z"}, {"uuid": "9b99fb9d-a43b-4468-9c66-1baede43cac1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-27596", "type": "seen", "source": "https://t.me/hacking_Attack/88268", "content": "Black Hat Ethical Hacking\nQNAP NAS Devices at Risk of Remote Malicious Code Injection\n\nQNAP NAS Devices at Risk of Remote Malicious Code InjectionPost Views: 237 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/12/Patreon.png Subscribe to Patreon to watch this episode.\nReading Time: 3 Minutes QNAP, a provider of Network-Attached Storage (NAS) devices, has issued a warning to its customers to install firmware updates that resolve a critical security vulnerability on its devices. The flaw, tracked as CVE-2022-27596, is rated as \u201cCritical\u201d by QNAP, with a CVSS v3 score of 9.8, and is described as a SQL injection flaw. \nThe vulnerability impacts the QTS 5.0.1 and QuTS hero h5.0.1 versions of the operating system and could allow remote attackers to inject malicious code.\nSee Also: So you want to be a hacker? Offensive Security, Bug Bounty Courses QNAP advise for device protectionQNAP has advised users running the affected versions of the operating system to upgrade to QTS 5.0.1.2234 build 20221201 or later, and QuTS hero h5.0.1.2248 build 20221215 or later, to ensure the protection of their devices.\n\nThe update can be performed by logging in as the admin user and navigating to the firmware update section in the Control Panel, or by downloading the update from QNAP\u2019s Download Center.\n\nIt is important for users to apply these security updates as soon as possible, as threat actors are known to target vulnerabilities in QNAP devices. \nThe company\u2019s devices are already the target of ongoing ransomware campaigns, such as DeadBolt and eCh0raix, which abuse vulnerabilities to encrypt data on exposed NAS devices.\nTrending: How to Exploit \u201cimproper error handling\u201d in Web Applications Trending: Offensive Security Tool: XSSRocket Always check for updatesIn conclusion, the critical security vulnerability reported by QNAP highlights the importance of keeping device firmware updated to ensure the protection of sensitive data.\nTrending: Cisco VPN Routers: 19,000 Devices Left Exposed to Remote Command Execution Exploit Chain\nAre u a security researcher? Or a company that writes articles or write ups about Cyber Security, Offensive Security (related to information security in general) that match with our specific audience and is worth sharing?\n\nIf you want to express your idea in an article contact us here for a quote: info@blackhatethicalhacking.com\nSource: bleepingcomputer.com Source Link https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Merch.png Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2023/02/Images-for-the-News-posts-4-300x150.png Sh1mmer: A New Exploit Enables Unenrollment of Enterprise-Managed ChromebooksFebruary 1, 2023\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2023/01/Images-for-the-News-posts-10-1-300x150.png PlugX Variant Uncovered: Document-Stealing Malware Targets USB DrivesJanuary 30, 2023\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2023/01/Images-for-the-News-posts-8-1-300x150.png Ransack Library\u2019s Search and Sort Feature Puts Ruby on Rails Applications at Risk of Information TheftJanuary 27, 2023\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2023/01/Images-for-the-News-posts-7-2-300x150.png Windows CryptoAPI Flaw Allows Attackers to Spoof Identity, PoC Exploit ReleasedJanuary 26, 2023\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/06/OffSec-Course.png Offensive Security & Ethical Hacking CourseBegin the learning curve of hacking now!\nThe post QNAP NAS Devices at Risk of Remote Malicious Code Injection first appeared on Black Hat Ethical Hacking.", "creation_timestamp": "2026-09-01T20:01:05.309006Z"}, {"uuid": "055bc8c2-53ca-4ead-8a59-54e2d662448e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-27596", "type": "seen", "source": "https://t.me/hacking_Attack/88041", "content": "Black Hat Ethical Hacking\nQNAP NAS Devices at Risk of Remote Malicious Code Injection\n\nQNAP NAS Devices at Risk of Remote Malicious Code InjectionPost Views: 55 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/12/Patreon.png Subscribe to Patreon to watch this episode.\nReading Time: 3 Minutes QNAP, a provider of Network-Attached Storage (NAS) devices, has issued a warning to its customers to install firmware updates that resolve a critical security vulnerability on its devices. The flaw, tracked as CVE-2022-27596, is rated as \u201cCritical\u201d by QNAP, with a CVSS v3 score of 9.8, and is described as a SQL injection flaw. \nThe vulnerability impacts the QTS 5.0.1 and QuTS hero h5.0.1 versions of the operating system and could allow remote attackers to inject malicious code.\nSee Also: So you want to be a hacker? Offensive Security, Bug Bounty Courses QNAP advise for device protectionQNAP has advised users running the affected versions of the operating system to upgrade to QTS 5.0.1.2234 build 20221201 or later, and QuTS hero h5.0.1.2248 build 20221215 or later, to ensure the protection of their devices.\n\nThe update can be performed by logging in as the admin user and navigating to the firmware update section in the Control Panel, or by downloading the update from QNAP\u2019s Download Center.\n\nIt is important for users to apply these security updates as soon as possible, as threat actors are known to target vulnerabilities in QNAP devices. \nThe company\u2019s devices are already the target of ongoing ransomware campaigns, such as DeadBolt and eCh0raix, which abuse vulnerabilities to encrypt data on exposed NAS devices.\nTrending: How to Exploit \u201cimproper error handling\u201d in Web Applications Trending: Offensive Security Tool: XSSRocket Always check for updatesIn conclusion, the critical security vulnerability reported by QNAP highlights the importance of keeping device firmware updated to ensure the protection of sensitive data.\nTrending: Cisco VPN Routers: 19,000 Devices Left Exposed to Remote Command Execution Exploit Chain\nAre u a security researcher? Or a company that writes articles or write ups about Cyber Security, Offensive Security (related to information security in general) that match with our specific audience and is worth sharing?\n\nIf you want to express your idea in an article contact us here for a quote: info@blackhatethicalhacking.com\nSource: bleepingcomputer.com Source Link https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Merch.png Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2023/01/Images-for-the-News-posts-10-1-300x150.png PlugX Variant Uncovered: Document-Stealing Malware Targets USB DrivesJanuary 30, 2023\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2023/01/Images-for-the-News-posts-8-1-300x150.png Ransack Library\u2019s Search and Sort Feature Puts Ruby on Rails Applications at Risk of Information TheftJanuary 27, 2023\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2023/01/Images-for-the-News-posts-7-2-300x150.png Windows CryptoAPI Flaw Allows Attackers to Spoof Identity, PoC Exploit ReleasedJanuary 26, 2023\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2023/01/Images-for-the-News-posts-6-3-300x150.png LearnPress: 75,000 WordPress Websites at Risk from Critical VulnerabilitiesJanuary 25, 2023\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/06/OffSec-Course.png Offensive Security & Ethical Hacking CourseBegin the learning curve of hacking now!\nThe post QNAP NAS Devices at Risk of Remote Malicious Code Injection first appeared on Black Hat Ethical Hacking.", "creation_timestamp": "2026-09-01T20:01:05.357115Z"}, {"uuid": "ea37c03b-5986-4178-ad5b-1598bad14385", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-27596", "type": "seen", "source": "https://t.me/hacking_Attack/88268", "content": "Black Hat Ethical Hacking\nQNAP NAS Devices at Risk of Remote Malicious Code Injection\n\nQNAP NAS Devices at Risk of Remote Malicious Code InjectionPost Views: 237 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/12/Patreon.png Subscribe to Patreon to watch this episode.\nReading Time: 3 Minutes QNAP, a provider of Network-Attached Storage (NAS) devices, has issued a warning to its customers to install firmware updates that resolve a critical security vulnerability on its devices. The flaw, tracked as CVE-2022-27596, is rated as \u201cCritical\u201d by QNAP, with a CVSS v3 score of 9.8, and is described as a SQL injection flaw. \nThe vulnerability impacts the QTS 5.0.1 and QuTS hero h5.0.1 versions of the operating system and could allow remote attackers to inject malicious code.\nSee Also: So you want to be a hacker? Offensive Security, Bug Bounty Courses QNAP advise for device protectionQNAP has advised users running the affected versions of the operating system to upgrade to QTS 5.0.1.2234 build 20221201 or later, and QuTS hero h5.0.1.2248 build 20221215 or later, to ensure the protection of their devices.\n\nThe update can be performed by logging in as the admin user and navigating to the firmware update section in the Control Panel, or by downloading the update from QNAP\u2019s Download Center.\n\nIt is important for users to apply these security updates as soon as possible, as threat actors are known to target vulnerabilities in QNAP devices. \nThe company\u2019s devices are already the target of ongoing ransomware campaigns, such as DeadBolt and eCh0raix, which abuse vulnerabilities to encrypt data on exposed NAS devices.\nTrending: How to Exploit \u201cimproper error handling\u201d in Web Applications Trending: Offensive Security Tool: XSSRocket Always check for updatesIn conclusion, the critical security vulnerability reported by QNAP highlights the importance of keeping device firmware updated to ensure the protection of sensitive data.\nTrending: Cisco VPN Routers: 19,000 Devices Left Exposed to Remote Command Execution Exploit Chain\nAre u a security researcher? Or a company that writes articles or write ups about Cyber Security, Offensive Security (related to information security in general) that match with our specific audience and is worth sharing?\n\nIf you want to express your idea in an article contact us here for a quote: info@blackhatethicalhacking.com\nSource: bleepingcomputer.com Source Link https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Merch.png Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2023/02/Images-for-the-News-posts-4-300x150.png Sh1mmer: A New Exploit Enables Unenrollment of Enterprise-Managed ChromebooksFebruary 1, 2023\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2023/01/Images-for-the-News-posts-10-1-300x150.png PlugX Variant Uncovered: Document-Stealing Malware Targets USB DrivesJanuary 30, 2023\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2023/01/Images-for-the-News-posts-8-1-300x150.png Ransack Library\u2019s Search and Sort Feature Puts Ruby on Rails Applications at Risk of Information TheftJanuary 27, 2023\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2023/01/Images-for-the-News-posts-7-2-300x150.png Windows CryptoAPI Flaw Allows Attackers to Spoof Identity, PoC Exploit ReleasedJanuary 26, 2023\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/06/OffSec-Course.png Offensive Security & Ethical Hacking CourseBegin the learning curve of hacking now!\nThe post QNAP NAS Devices at Risk of Remote Malicious Code Injection first appeared on Black Hat Ethical Hacking.", "creation_timestamp": "2026-09-02T01:01:25.964438Z"}, {"uuid": "99d58f8a-c199-46ee-9acd-dc4982a0736f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-27596", "type": "seen", "source": "https://t.me/hacking_Attack/88041", "content": "Black Hat Ethical Hacking\nQNAP NAS Devices at Risk of Remote Malicious Code Injection\n\nQNAP NAS Devices at Risk of Remote Malicious Code InjectionPost Views: 55 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/12/Patreon.png Subscribe to Patreon to watch this episode.\nReading Time: 3 Minutes QNAP, a provider of Network-Attached Storage (NAS) devices, has issued a warning to its customers to install firmware updates that resolve a critical security vulnerability on its devices. The flaw, tracked as CVE-2022-27596, is rated as \u201cCritical\u201d by QNAP, with a CVSS v3 score of 9.8, and is described as a SQL injection flaw. \nThe vulnerability impacts the QTS 5.0.1 and QuTS hero h5.0.1 versions of the operating system and could allow remote attackers to inject malicious code.\nSee Also: So you want to be a hacker? Offensive Security, Bug Bounty Courses QNAP advise for device protectionQNAP has advised users running the affected versions of the operating system to upgrade to QTS 5.0.1.2234 build 20221201 or later, and QuTS hero h5.0.1.2248 build 20221215 or later, to ensure the protection of their devices.\n\nThe update can be performed by logging in as the admin user and navigating to the firmware update section in the Control Panel, or by downloading the update from QNAP\u2019s Download Center.\n\nIt is important for users to apply these security updates as soon as possible, as threat actors are known to target vulnerabilities in QNAP devices. \nThe company\u2019s devices are already the target of ongoing ransomware campaigns, such as DeadBolt and eCh0raix, which abuse vulnerabilities to encrypt data on exposed NAS devices.\nTrending: How to Exploit \u201cimproper error handling\u201d in Web Applications Trending: Offensive Security Tool: XSSRocket Always check for updatesIn conclusion, the critical security vulnerability reported by QNAP highlights the importance of keeping device firmware updated to ensure the protection of sensitive data.\nTrending: Cisco VPN Routers: 19,000 Devices Left Exposed to Remote Command Execution Exploit Chain\nAre u a security researcher? Or a company that writes articles or write ups about Cyber Security, Offensive Security (related to information security in general) that match with our specific audience and is worth sharing?\n\nIf you want to express your idea in an article contact us here for a quote: info@blackhatethicalhacking.com\nSource: bleepingcomputer.com Source Link https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Merch.png Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2023/01/Images-for-the-News-posts-10-1-300x150.png PlugX Variant Uncovered: Document-Stealing Malware Targets USB DrivesJanuary 30, 2023\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2023/01/Images-for-the-News-posts-8-1-300x150.png Ransack Library\u2019s Search and Sort Feature Puts Ruby on Rails Applications at Risk of Information TheftJanuary 27, 2023\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2023/01/Images-for-the-News-posts-7-2-300x150.png Windows CryptoAPI Flaw Allows Attackers to Spoof Identity, PoC Exploit ReleasedJanuary 26, 2023\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2023/01/Images-for-the-News-posts-6-3-300x150.png LearnPress: 75,000 WordPress Websites at Risk from Critical VulnerabilitiesJanuary 25, 2023\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/06/OffSec-Course.png Offensive Security & Ethical Hacking CourseBegin the learning curve of hacking now!\nThe post QNAP NAS Devices at Risk of Remote Malicious Code Injection first appeared on Black Hat Ethical Hacking.", "creation_timestamp": "2026-09-02T01:01:26.013194Z"}, {"uuid": "47594817-204d-469a-a7ec-42189911e458", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-27596", "type": "seen", "source": "https://t.me/cissp/6573", "content": "Don't risk losing your data!\nQNAP has released security updates to address a critical vulnerability (CVE-2022-27596 / CVSS 9.8) in the NAS devices QTS 5.0.1 & QuTS hero h5.0.1 that can be used to inject arbitrary code.\nRead: https://thehackernews.com/2023/01/qnap-fixes-critical-vulnerability-in.html\n\n\n-Cyber Security awareness-\n\nUp2date 4 Defence Today,\nSecure Tomorrow\n@CisoasaService\n1401.11.10", "creation_timestamp": "2026-09-02T01:04:03.826601Z"}, {"uuid": "b3581076-b3f4-4ad1-bf3e-e6b409801ae3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-27596", "type": "exploited", "source": "https://t.me/hacking_Attack/88041", "content": "Black Hat Ethical Hacking\nQNAP NAS Devices at Risk of Remote Malicious Code Injection\n\nQNAP NAS Devices at Risk of Remote Malicious Code InjectionPost Views: 55 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/12/Patreon.png Subscribe to Patreon to watch this episode.\nReading Time: 3 Minutes QNAP, a provider of Network-Attached Storage (NAS) devices, has issued a warning to its customers to install firmware updates that resolve a critical security vulnerability on its devices. The flaw, tracked as CVE-2022-27596, is rated as \u201cCritical\u201d by QNAP, with a CVSS v3 score of 9.8, and is described as a SQL injection flaw. \nThe vulnerability impacts the QTS 5.0.1 and QuTS hero h5.0.1 versions of the operating system and could allow remote attackers to inject malicious code.\nSee Also: So you want to be a hacker? Offensive Security, Bug Bounty Courses QNAP advise for device protectionQNAP has advised users running the affected versions of the operating system to upgrade to QTS 5.0.1.2234 build 20221201 or later, and QuTS hero h5.0.1.2248 build 20221215 or later, to ensure the protection of their devices.\n\nThe update can be performed by logging in as the admin user and navigating to the firmware update section in the Control Panel, or by downloading the update from QNAP\u2019s Download Center.\n\nIt is important for users to apply these security updates as soon as possible, as threat actors are known to target vulnerabilities in QNAP devices. \nThe company\u2019s devices are already the target of ongoing ransomware campaigns, such as DeadBolt and eCh0raix, which abuse vulnerabilities to encrypt data on exposed NAS devices.\nTrending: How to Exploit \u201cimproper error handling\u201d in Web Applications Trending: Offensive Security Tool: XSSRocket Always check for updatesIn conclusion, the critical security vulnerability reported by QNAP highlights the importance of keeping device firmware updated to ensure the protection of sensitive data.\nTrending: Cisco VPN Routers: 19,000 Devices Left Exposed to Remote Command Execution Exploit Chain\nAre u a security researcher? Or a company that writes articles or write ups about Cyber Security, Offensive Security (related to information security in general) that match with our specific audience and is worth sharing?\n\nIf you want to express your idea in an article contact us here for a quote: info@blackhatethicalhacking.com\nSource: bleepingcomputer.com Source Link https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Merch.png Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2023/01/Images-for-the-News-posts-10-1-300x150.png PlugX Variant Uncovered: Document-Stealing Malware Targets USB DrivesJanuary 30, 2023\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2023/01/Images-for-the-News-posts-8-1-300x150.png Ransack Library\u2019s Search and Sort Feature Puts Ruby on Rails Applications at Risk of Information TheftJanuary 27, 2023\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2023/01/Images-for-the-News-posts-7-2-300x150.png Windows CryptoAPI Flaw Allows Attackers to Spoof Identity, PoC Exploit ReleasedJanuary 26, 2023\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2023/01/Images-for-the-News-posts-6-3-300x150.png LearnPress: 75,000 WordPress Websites at Risk from Critical VulnerabilitiesJanuary 25, 2023\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/06/OffSec-Course.png Offensive Security & Ethical Hacking CourseBegin the learning curve of hacking now!\nThe post QNAP NAS Devices at Risk of Remote Malicious Code Injection first appeared on Black Hat Ethical Hacking.", "creation_timestamp": "2026-09-04T23:00:04.648543Z"}, {"uuid": "db3f292d-b71f-47ae-b74e-d334344d20f8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-27596", "type": "exploited", "source": "https://t.me/hacking_Attack/88268", "content": "Black Hat Ethical Hacking\nQNAP NAS Devices at Risk of Remote Malicious Code Injection\n\nQNAP NAS Devices at Risk of Remote Malicious Code InjectionPost Views: 237 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/12/Patreon.png Subscribe to Patreon to watch this episode.\nReading Time: 3 Minutes QNAP, a provider of Network-Attached Storage (NAS) devices, has issued a warning to its customers to install firmware updates that resolve a critical security vulnerability on its devices. The flaw, tracked as CVE-2022-27596, is rated as \u201cCritical\u201d by QNAP, with a CVSS v3 score of 9.8, and is described as a SQL injection flaw. \nThe vulnerability impacts the QTS 5.0.1 and QuTS hero h5.0.1 versions of the operating system and could allow remote attackers to inject malicious code.\nSee Also: So you want to be a hacker? Offensive Security, Bug Bounty Courses QNAP advise for device protectionQNAP has advised users running the affected versions of the operating system to upgrade to QTS 5.0.1.2234 build 20221201 or later, and QuTS hero h5.0.1.2248 build 20221215 or later, to ensure the protection of their devices.\n\nThe update can be performed by logging in as the admin user and navigating to the firmware update section in the Control Panel, or by downloading the update from QNAP\u2019s Download Center.\n\nIt is important for users to apply these security updates as soon as possible, as threat actors are known to target vulnerabilities in QNAP devices. \nThe company\u2019s devices are already the target of ongoing ransomware campaigns, such as DeadBolt and eCh0raix, which abuse vulnerabilities to encrypt data on exposed NAS devices.\nTrending: How to Exploit \u201cimproper error handling\u201d in Web Applications Trending: Offensive Security Tool: XSSRocket Always check for updatesIn conclusion, the critical security vulnerability reported by QNAP highlights the importance of keeping device firmware updated to ensure the protection of sensitive data.\nTrending: Cisco VPN Routers: 19,000 Devices Left Exposed to Remote Command Execution Exploit Chain\nAre u a security researcher? Or a company that writes articles or write ups about Cyber Security, Offensive Security (related to information security in general) that match with our specific audience and is worth sharing?\n\nIf you want to express your idea in an article contact us here for a quote: info@blackhatethicalhacking.com\nSource: bleepingcomputer.com Source Link https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Merch.png Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2023/02/Images-for-the-News-posts-4-300x150.png Sh1mmer: A New Exploit Enables Unenrollment of Enterprise-Managed ChromebooksFebruary 1, 2023\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2023/01/Images-for-the-News-posts-10-1-300x150.png PlugX Variant Uncovered: Document-Stealing Malware Targets USB DrivesJanuary 30, 2023\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2023/01/Images-for-the-News-posts-8-1-300x150.png Ransack Library\u2019s Search and Sort Feature Puts Ruby on Rails Applications at Risk of Information TheftJanuary 27, 2023\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2023/01/Images-for-the-News-posts-7-2-300x150.png Windows CryptoAPI Flaw Allows Attackers to Spoof Identity, PoC Exploit ReleasedJanuary 26, 2023\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/06/OffSec-Course.png Offensive Security & Ethical Hacking CourseBegin the learning curve of hacking now!\nThe post QNAP NAS Devices at Risk of Remote Malicious Code Injection first appeared on Black Hat Ethical Hacking.", "creation_timestamp": "2026-09-04T23:00:04.708146Z"}, {"uuid": "4b420a53-d39b-49d3-b5a0-4ef93bbb047b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-27596", "type": "exploited", "source": "https://t.me/hacking_Attack/88041", "content": "Black Hat Ethical Hacking\nQNAP NAS Devices at Risk of Remote Malicious Code Injection\n\nQNAP NAS Devices at Risk of Remote Malicious Code InjectionPost Views: 55 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/12/Patreon.png Subscribe to Patreon to watch this episode.\nReading Time: 3 Minutes QNAP, a provider of Network-Attached Storage (NAS) devices, has issued a warning to its customers to install firmware updates that resolve a critical security vulnerability on its devices. The flaw, tracked as CVE-2022-27596, is rated as \u201cCritical\u201d by QNAP, with a CVSS v3 score of 9.8, and is described as a SQL injection flaw. \nThe vulnerability impacts the QTS 5.0.1 and QuTS hero h5.0.1 versions of the operating system and could allow remote attackers to inject malicious code.\nSee Also: So you want to be a hacker? Offensive Security, Bug Bounty Courses QNAP advise for device protectionQNAP has advised users running the affected versions of the operating system to upgrade to QTS 5.0.1.2234 build 20221201 or later, and QuTS hero h5.0.1.2248 build 20221215 or later, to ensure the protection of their devices.\n\nThe update can be performed by logging in as the admin user and navigating to the firmware update section in the Control Panel, or by downloading the update from QNAP\u2019s Download Center.\n\nIt is important for users to apply these security updates as soon as possible, as threat actors are known to target vulnerabilities in QNAP devices. \nThe company\u2019s devices are already the target of ongoing ransomware campaigns, such as DeadBolt and eCh0raix, which abuse vulnerabilities to encrypt data on exposed NAS devices.\nTrending: How to Exploit \u201cimproper error handling\u201d in Web Applications Trending: Offensive Security Tool: XSSRocket Always check for updatesIn conclusion, the critical security vulnerability reported by QNAP highlights the importance of keeping device firmware updated to ensure the protection of sensitive data.\nTrending: Cisco VPN Routers: 19,000 Devices Left Exposed to Remote Command Execution Exploit Chain\nAre u a security researcher? Or a company that writes articles or write ups about Cyber Security, Offensive Security (related to information security in general) that match with our specific audience and is worth sharing?\n\nIf you want to express your idea in an article contact us here for a quote: info@blackhatethicalhacking.com\nSource: bleepingcomputer.com Source Link https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Merch.png Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2023/01/Images-for-the-News-posts-10-1-300x150.png PlugX Variant Uncovered: Document-Stealing Malware Targets USB DrivesJanuary 30, 2023\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2023/01/Images-for-the-News-posts-8-1-300x150.png Ransack Library\u2019s Search and Sort Feature Puts Ruby on Rails Applications at Risk of Information TheftJanuary 27, 2023\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2023/01/Images-for-the-News-posts-7-2-300x150.png Windows CryptoAPI Flaw Allows Attackers to Spoof Identity, PoC Exploit ReleasedJanuary 26, 2023\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2023/01/Images-for-the-News-posts-6-3-300x150.png LearnPress: 75,000 WordPress Websites at Risk from Critical VulnerabilitiesJanuary 25, 2023\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/06/OffSec-Course.png Offensive Security & Ethical Hacking CourseBegin the learning curve of hacking now!\nThe post QNAP NAS Devices at Risk of Remote Malicious Code Injection first appeared on Black Hat Ethical Hacking.", "creation_timestamp": "2026-09-05T01:00:14.418759Z"}, {"uuid": "c392ef6c-adf5-4e44-a192-e3449946d219", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-27596", "type": "exploited", "source": "https://t.me/hacking_Attack/88268", "content": "Black Hat Ethical Hacking\nQNAP NAS Devices at Risk of Remote Malicious Code Injection\n\nQNAP NAS Devices at Risk of Remote Malicious Code InjectionPost Views: 237 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/12/Patreon.png Subscribe to Patreon to watch this episode.\nReading Time: 3 Minutes QNAP, a provider of Network-Attached Storage (NAS) devices, has issued a warning to its customers to install firmware updates that resolve a critical security vulnerability on its devices. The flaw, tracked as CVE-2022-27596, is rated as \u201cCritical\u201d by QNAP, with a CVSS v3 score of 9.8, and is described as a SQL injection flaw. \nThe vulnerability impacts the QTS 5.0.1 and QuTS hero h5.0.1 versions of the operating system and could allow remote attackers to inject malicious code.\nSee Also: So you want to be a hacker? Offensive Security, Bug Bounty Courses QNAP advise for device protectionQNAP has advised users running the affected versions of the operating system to upgrade to QTS 5.0.1.2234 build 20221201 or later, and QuTS hero h5.0.1.2248 build 20221215 or later, to ensure the protection of their devices.\n\nThe update can be performed by logging in as the admin user and navigating to the firmware update section in the Control Panel, or by downloading the update from QNAP\u2019s Download Center.\n\nIt is important for users to apply these security updates as soon as possible, as threat actors are known to target vulnerabilities in QNAP devices. \nThe company\u2019s devices are already the target of ongoing ransomware campaigns, such as DeadBolt and eCh0raix, which abuse vulnerabilities to encrypt data on exposed NAS devices.\nTrending: How to Exploit \u201cimproper error handling\u201d in Web Applications Trending: Offensive Security Tool: XSSRocket Always check for updatesIn conclusion, the critical security vulnerability reported by QNAP highlights the importance of keeping device firmware updated to ensure the protection of sensitive data.\nTrending: Cisco VPN Routers: 19,000 Devices Left Exposed to Remote Command Execution Exploit Chain\nAre u a security researcher? Or a company that writes articles or write ups about Cyber Security, Offensive Security (related to information security in general) that match with our specific audience and is worth sharing?\n\nIf you want to express your idea in an article contact us here for a quote: info@blackhatethicalhacking.com\nSource: bleepingcomputer.com Source Link https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Merch.png Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2023/02/Images-for-the-News-posts-4-300x150.png Sh1mmer: A New Exploit Enables Unenrollment of Enterprise-Managed ChromebooksFebruary 1, 2023\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2023/01/Images-for-the-News-posts-10-1-300x150.png PlugX Variant Uncovered: Document-Stealing Malware Targets USB DrivesJanuary 30, 2023\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2023/01/Images-for-the-News-posts-8-1-300x150.png Ransack Library\u2019s Search and Sort Feature Puts Ruby on Rails Applications at Risk of Information TheftJanuary 27, 2023\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2023/01/Images-for-the-News-posts-7-2-300x150.png Windows CryptoAPI Flaw Allows Attackers to Spoof Identity, PoC Exploit ReleasedJanuary 26, 2023\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/06/OffSec-Course.png Offensive Security & Ethical Hacking CourseBegin the learning curve of hacking now!\nThe post QNAP NAS Devices at Risk of Remote Malicious Code Injection first appeared on Black Hat Ethical Hacking.", "creation_timestamp": "2026-09-05T01:00:14.475490Z"}, {"uuid": "75f4fe38-1c46-4e24-bea7-7180e7d59310", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-27596", "type": "seen", "source": "https://t.me/cissp/6573", "content": "Don't risk losing your data!\nQNAP has released security updates to address a critical vulnerability (CVE-2022-27596 / CVSS 9.8) in the NAS devices QTS 5.0.1 & QuTS hero h5.0.1 that can be used to inject arbitrary code.\nRead: https://thehackernews.com/2023/01/qnap-fixes-critical-vulnerability-in.html\n\n\n-Cyber Security awareness-\n\nUp2date 4 Defence Today,\nSecure Tomorrow\n@CisoasaService\n1401.11.10", "creation_timestamp": "2026-09-10T03:00:04.091498Z"}, {"uuid": "78ea358e-5927-402a-9ced-6dab51096c71", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-27596", "type": "seen", "source": "https://t.me/cissp/6573", "content": "Don't risk losing your data!\nQNAP has released security updates to address a critical vulnerability (CVE-2022-27596 / CVSS 9.8) in the NAS devices QTS 5.0.1 & QuTS hero h5.0.1 that can be used to inject arbitrary code.\nRead: https://thehackernews.com/2023/01/qnap-fixes-critical-vulnerability-in.html\n\n\n-Cyber Security awareness-\n\nUp2date 4 Defence Today,\nSecure Tomorrow\n@CisoasaService\n1401.11.10", "creation_timestamp": "2026-09-11T00:00:53.780966Z"}]}