CVE Feed

    Dashboard / CVE / CVE-2022-27598

    CVE-2022-27598

    A vulnerability has been reported to affect QNAP operating systems. If exploited, the out-of-bounds read vulnerability allows remote authenticated administrators to get secret values. The vulnerability affects the following QNAP operating systems: QTS, QuTS hero, QuTScloud, QVP (QVR Pro appliances) We have already fixed the vulnerability in the following versions: QTS 5.0.1.2346 build 20230322 and later QuTS hero h5.0.1.2348 build 20230324 and later

    Published:Mar 29, 2023
    Last Modified:Feb 12, 2025
    EPS:Mar 29, 2023
    EPSS Score:0.00264
    CVSS Score:2.7

    Affected Products

    Vendor
    Qnap
    Product
    Qts
    Vendor
    Qnap
    Product
    Quts Hero
    Vendor
    Qnap
    Product
    Qutscloud
    Vendor
    Qnap
    Product
    Qvp-21a
    Vendor
    Qnap
    Product
    Qvp-21a Firmware
    Vendor
    Qnap
    Product
    Qvp-41a
    Vendor
    Qnap
    Product
    Qvp-41a Firmware
    Vendor
    Qnap
    Product
    Qvp-41b
    Vendor
    Qnap
    Product
    Qvp-41b Firmware
    Vendor
    Qnap
    Product
    Qvp-63a
    Vendor
    Qnap
    Product
    Qvp-63a Firmware
    Vendor
    Qnap
    Product
    Qvp-63b
    Vendor
    Qnap
    Product
    Qvp-63b Firmware
    Vendor
    Qnap
    Product
    Qvp-85a
    Vendor
    Qnap
    Product
    Qvp-85a Firmware
    Vendor
    Qnap
    Product
    Qvp-85b
    Vendor
    Qnap
    Product
    Qvp-85b Firmware

    Exploits

    No exploit reference

    Common Weakness Enumeration

    CWE-125 Out-of-bounds Read

    Common Attack Pattern Enumeration and Classification (CAPEC)

    CAPEC-540 Overread Buffers

    Related CVEs

    CVE-2026-24719 (CVSS 6.1) — A command injection vulnerability has been reported to affect several QNAP operating system versions. If a rem…
    CVE-2026-24717 (CVSS 1.2) — A path traversal vulnerability has been reported to affect several QNAP operating system versions. If a remote…
    CVE-2026-24716 (CVSS 1.2) — A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. I…
    CVE-2026-22893 (CVSS 8.6) — A command injection vulnerability has been reported to affect several QNAP operating system versions. If a rem…
    CVE-2025-66281 (CVSS 6.9) — A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. T…
    CVE-2025-66280 (CVSS 5.1) — An integer overflow or wraparound vulnerability has been reported to affect several QNAP operating system vers…
    CVE-2025-66279 (CVSS 8.6) — A command injection vulnerability has been reported to affect several QNAP operating system versions. If a rem…
    CVE-2025-66273 (CVSS 8.6) — A command injection vulnerability has been reported to affect several QNAP operating system versions. If a rem…
    CVE-2025-66276 (CVSS 9.2) — QuTS hero is not affected. We have already fixed the vulnerability in the following version: QTS 5.2.7.3256 b…
    CVE-2025-62858 (CVSS 5.1) — A buffer overflow vulnerability has been reported to affect several QNAP operating system versions. If a remot…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High