{"uuid": "ea37c03b-5986-4178-ad5b-1598bad14385", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-27596", "type": "seen", "source": "https://t.me/hacking_Attack/88268", "content": "Black Hat Ethical Hacking\nQNAP NAS Devices at Risk of Remote Malicious Code Injection\n\nQNAP NAS Devices at Risk of Remote Malicious Code InjectionPost Views: 237 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/12/Patreon.png Subscribe to Patreon to watch this episode.\nReading Time: 3 Minutes QNAP, a provider of Network-Attached Storage (NAS) devices, has issued a warning to its customers to install firmware updates that resolve a critical security vulnerability on its devices. The flaw, tracked as CVE-2022-27596, is rated as \u201cCritical\u201d by QNAP, with a CVSS v3 score of 9.8, and is described as a SQL injection flaw. \nThe vulnerability impacts the QTS 5.0.1 and QuTS hero h5.0.1 versions of the operating system and could allow remote attackers to inject malicious code.\nSee Also: So you want to be a hacker? Offensive Security, Bug Bounty Courses QNAP advise for device protectionQNAP has advised users running the affected versions of the operating system to upgrade to QTS 5.0.1.2234 build 20221201 or later, and QuTS hero h5.0.1.2248 build 20221215 or later, to ensure the protection of their devices.\n\nThe update can be performed by logging in as the admin user and navigating to the firmware update section in the Control Panel, or by downloading the update from QNAP\u2019s Download Center.\n\nIt is important for users to apply these security updates as soon as possible, as threat actors are known to target vulnerabilities in QNAP devices. \nThe company\u2019s devices are already the target of ongoing ransomware campaigns, such as DeadBolt and eCh0raix, which abuse vulnerabilities to encrypt data on exposed NAS devices.\nTrending: How to Exploit \u201cimproper error handling\u201d in Web Applications Trending: Offensive Security Tool: XSSRocket Always check for updatesIn conclusion, the critical security vulnerability reported by QNAP highlights the importance of keeping device firmware updated to ensure the protection of sensitive data.\nTrending: Cisco VPN Routers: 19,000 Devices Left Exposed to Remote Command Execution Exploit Chain\nAre u a security researcher? Or a company that writes articles or write ups about Cyber Security, Offensive Security (related to information security in general) that match with our specific audience and is worth sharing?\n\nIf you want to express your idea in an article contact us here for a quote: info@blackhatethicalhacking.com\nSource: bleepingcomputer.com Source Link https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Merch.png Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2023/02/Images-for-the-News-posts-4-300x150.png Sh1mmer: A New Exploit Enables Unenrollment of Enterprise-Managed ChromebooksFebruary 1, 2023\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2023/01/Images-for-the-News-posts-10-1-300x150.png PlugX Variant Uncovered: Document-Stealing Malware Targets USB DrivesJanuary 30, 2023\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2023/01/Images-for-the-News-posts-8-1-300x150.png Ransack Library\u2019s Search and Sort Feature Puts Ruby on Rails Applications at Risk of Information TheftJanuary 27, 2023\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2023/01/Images-for-the-News-posts-7-2-300x150.png Windows CryptoAPI Flaw Allows Attackers to Spoof Identity, PoC Exploit ReleasedJanuary 26, 2023\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/06/OffSec-Course.png Offensive Security & Ethical Hacking CourseBegin the learning curve of hacking now!\nThe post QNAP NAS Devices at Risk of Remote Malicious Code Injection first appeared on Black Hat Ethical Hacking.", "creation_timestamp": "2026-09-02T01:01:25.964438Z"}