The well-known NAS manufacturer QNAP reports two highly dangerous vulnerabilities in its network products and another vulnerability in its VPN device client for Windows. A remote attack is possible through the gaps - suitable patches are available.
The vulnerabilities announced by QNAP affect many applications used within the network products. The services also operate and work in large NAS systems for the SME sector. Therefore, in addition to smaller, privately used NAS systems or cameras, many company products are also affected by the security gaps.
Remote takeover for DoS attack possible
QNAP reports that a vulnerability related to uncontrolled resource consumption affects several QNAP operating systems. If the vulnerability is exploited, remote users can launch a denial of service (DoS) attack. The vulnerability is listed as CVE-2022-27600. The exact CVSS value is not known, but must be in the range of 7.0 to 8.9 for Highly Dangerous.
The vulnerability has already been fixed in the following versions that are available for update:
- QTS 5.0.1.2277 Build 20230112 and later
- QTS 4.5.4.2280 Build 20230112 and later
- QuTS hero h5.0.1.2277 build 20230112 and later
- QuTS hero h4.5.4.2374 build 20230417 and later
- QuTScloud c5.0.1.2374 build 20230419 and later
- QVR Pro Appliance 2.3.1.0476 and later
Another vulnerability in the QVPN Device Client
Furthermore, QNAP reports a vulnerability in its QVPN Device Client for Windows. The vulnerability is also considered highly dangerous under CVE-2022-27595. There, loading libraries is insecure and may affect devices running the QVPN Device Client for Windows. If exploited, this vulnerability could allow locally authenticated users to execute code by insecurely loading the library. The QVPN Device Client for macOS, Android and iOS is not affected by the vulnerability.
An update is also available for this gap:
QVPN Device Client for Windows, version 2.0.0.1316 and higher
More at QNAP.com