CVE-2022-27597

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2022-27597
A vulnerability has been reported to affect QNAP operating systems. If exploited, the out-of-bounds read vulnerability allows remote authenticated administrators to get secret values. The vulnerability affects the following QNAP operating systems: QTS, QuTS hero, QuTScloud, QVP (QVR Pro appliances) We have already fixed the vulnerability in the following versions: QTS 5.0.1.2346 build 20230322 and later QuTS hero h5.0.1.2348 build 20230324 and later

2.7 /10

CVSS v3 : LOW

V3 Legend

Vector :

Exploitability : 1.2 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://www.qnap.com/en/security-advisory/qsa-23-06 Vendor Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:qnap:qvr:-:*:*:*:*:*:*:*
cpe:2.3:o:qnap:qts:*:*:*:*:*:*:*:*
cpe:2.3:o:qnap:quts_hero:*:*:*:*:*:*:*:*
cpe:2.3:o:qnap:qutscloud:-:*:*:*:*:*:*:*

Configuration 2 (hide)

AND
cpe:2.3:o:qnap:qvp-41b_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:qnap:qvp-41b:-:*:*:*:*:*:*:*

Configuration 3 (hide)

AND
cpe:2.3:o:qnap:qvp-63b_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:qnap:qvp-63b:-:*:*:*:*:*:*:*

Configuration 4 (hide)

AND
cpe:2.3:o:qnap:qvp-85b_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:qnap:qvp-85b:-:*:*:*:*:*:*:*

Configuration 5 (hide)

AND
cpe:2.3:o:qnap:qvp-21a_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:qnap:qvp-21a:-:*:*:*:*:*:*:*

Configuration 6 (hide)

AND
cpe:2.3:o:qnap:qvp-41a_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:qnap:qvp-41a:-:*:*:*:*:*:*:*

Configuration 7 (hide)

AND
cpe:2.3:o:qnap:qvp-63a_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:qnap:qvp-63a:-:*:*:*:*:*:*:*

Configuration 8 (hide)

AND
cpe:2.3:o:qnap:qvp-85a_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:qnap:qvp-85a:-:*:*:*:*:*:*:*
History

01 Sep 2023, 17:10

Type Values Removed Values Added
CVSS v2 : unknown
v3 : 4.3 		v2 : unknown
v3 : 2.7

20 Apr 2023, 14:15

Type Values Removed Values Added
Summary A vulnerability has been reported to affect QNAP operating systems. If exploited, the out-of-bounds read vulnerability allows remote authenticated administrators to get secret values. The vulnerability affects the following QNAP operating systems: QTS, QuTS hero, QuTScloud, QVP (QVR Pro appliances) We have already fixed the vulnerability in the following versions: QTS 5.0.1.2346 build 20230322 and later QuTS hero h5.0.1.2348 build 20230324 and later A vulnerability has been reported to affect QNAP operating systems. If exploited, the out-of-bounds read vulnerability allows remote authenticated administrators to get secret values. The vulnerability affects the following QNAP operating systems: QTS, QuTS hero, QuTScloud, QVP (QVR Pro appliances) We have already fixed the vulnerability in the following versions: QTS 5.0.1.2346 build 20230322 and later QuTS hero h5.0.1.2348 build 20230324 and later

20 Apr 2023, 13:15

Type Values Removed Values Added
Summary A vulnerability have been reported to affect multiple QNAP operating systems. If exploited, the vulnerability allow remote authenticated users to get secret values. The vulnerabilities affect the following QNAP operating systems: QTS, QuTS hero, QuTScloud, QVP (QVR Pro appliances) We have already fixed the vulnerabilities in the following operating system versions: QTS 5.0.1.2346 build 20230322 and later QuTS hero h5.0.1.2348 build 20230324 and later A vulnerability has been reported to affect QNAP operating systems. If exploited, the out-of-bounds read vulnerability allows remote authenticated administrators to get secret values. The vulnerability affects the following QNAP operating systems: QTS, QuTS hero, QuTScloud, QVP (QVR Pro appliances) We have already fixed the vulnerability in the following versions: QTS 5.0.1.2346 build 20230322 and later QuTS hero h5.0.1.2348 build 20230324 and later

06 Apr 2023, 18:16

Type Values Removed Values Added
CWE NVD-CWE-noinfo
CPE cpe:2.3:h:qnap:qvp-21a:-:*:*:*:*:*:*:*
cpe:2.3:o:qnap:qvp-41b_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:qnap:quts_hero:*:*:*:*:*:*:*:*
cpe:2.3:h:qnap:qvp-63a:-:*:*:*:*:*:*:*
cpe:2.3:h:qnap:qvp-41a:-:*:*:*:*:*:*:*
cpe:2.3:o:qnap:qvp-85b_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:qnap:qvp-63b:-:*:*:*:*:*:*:*
cpe:2.3:o:qnap:qutscloud:-:*:*:*:*:*:*:*
cpe:2.3:o:qnap:qvp-41a_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:qnap:qts:*:*:*:*:*:*:*:*
cpe:2.3:h:qnap:qvp-85a:-:*:*:*:*:*:*:*
cpe:2.3:o:qnap:qvp-21a_firmware:-:*:*:*:*:*:*:*
cpe:2.3:a:qnap:qvr:-:*:*:*:*:*:*:*
cpe:2.3:o:qnap:qvp-63b_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:qnap:qvp-63a_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:qnap:qvp-41b:-:*:*:*:*:*:*:*
cpe:2.3:h:qnap:qvp-85b:-:*:*:*:*:*:*:*
cpe:2.3:o:qnap:qvp-85a_firmware:-:*:*:*:*:*:*:*
References (MISC) https://www.qnap.com/en/security-advisory/qsa-23-06 - (MISC) https://www.qnap.com/en/security-advisory/qsa-23-06 - Vendor Advisory
First Time Qnap qvp-85b Firmware
Qnap qvp-85b
Qnap qvp-63a Firmware
Qnap qvp-63b
Qnap qvp-41b Firmware
Qnap qutscloud
Qnap qvp-41b
Qnap qvr
Qnap quts Hero
Qnap qvp-85a
Qnap qvp-63a
Qnap qvp-85a Firmware
Qnap
Qnap qvp-21a Firmware
Qnap qts
Qnap qvp-21a
Qnap qvp-41a Firmware
Qnap qvp-63b Firmware
Qnap qvp-41a
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 4.3

29 Mar 2023, 07:29

Type Values Removed Values Added
New CVE
Information

Published : 2023-03-29 07:15

Updated : 2023-12-10 15:01

NVD link : CVE-2022-27597

Mitre link : CVE-2022-27597

CVE.ORG link : CVE-2022-27597

JSON object : View

Products Affected

qnap

  • qutscloud
  • qvp-85a_firmware
  • qvp-85a
  • qvp-41b_firmware
  • qvp-41a
  • qvp-63a
  • qvp-63b
  • qvp-85b_firmware
  • qvp-21a
  • qvp-63a_firmware
  • qts
  • qvp-41b
  • qvp-41a_firmware
  • qvr
  • qvp-21a_firmware
  • quts_hero
  • qvp-85b
  • qvp-63b_firmware
CWE
NVD-CWE-noinfo CWE-125

Out-of-bounds Read

CWE-1295

Debug Messages Revealing Unnecessary Information

CWE-489

Active Debug Code