QNAP, Taiwanese maker of network-hooked up storage (NAS) equipment, on Friday produced security updates to patch nine security weaknesses, like a critical issue that could be exploited to get above an impacted method.
“A vulnerability has been noted to influence QNAP VS Sequence NVR working QVR,” QNAP explained in an advisory. “If exploited, this vulnerability makes it possible for distant attackers to operate arbitrary commands.”
Tracked as CVE-2022-27588 (CVSS score: 9.8), the vulnerability has been addressed in QVR 5.1.6 build 20220401 and later. Credited with reporting the flaw is the Japan Laptop Unexpected emergency Response Group Coordination Middle (JPCERT/CC).
Apart from the critical shortcoming, QNAP has also solved 3 substantial-severity and five medium-severity bugs in its program –
- CVE-2021-38693 (CVSS rating: 5.3) – A route traversal vulnerability in thttpd impacting QNAP equipment managing QTS, QuTS hero, QuTScloud, and QVR Pro Equipment, leading to info disclosure
- CVE-2021-44051 (CVSS rating: 8.8) – A command injection vulnerability in QNAP gadgets operating QTS, QuTS hero, and QuTScloud, resulting in arbitrary command execution
- CVE-2021-44052 (CVSS rating: 6.5) – An inappropriate hyperlink resolution in advance of file entry (“website link following”) vulnerability in QNAP equipment operating QTS, QuTS hero, and QuTScloud, allowing attackers to study/write files in arbitrary file spots
- CVE-2021-44053 (CVSS rating: 5.7) – A cross-site scripting (XSS) vulnerability in QNAP products jogging QTS, QuTS hero, and QuTScloud, leading to code injection
- CVE-2021-44054 (CVSS score: 4.3) – An open up redirect vulnerability in QNAP products operating QTS, QuTS hero, and QuTScloud, creating it attainable to redirect customers to a rogue web pages
- CVE-2021-44055 (CVSS score: 5.3) – A missing authorization vulnerability in QNAP devices managing Online video Station, permitting attackers to obtain knowledge or complete unauthorized steps
- CVE-2021-44056 (CVSS rating: 7.1) – An incorrect authentication vulnerability in QNAP units running Video Station, major to system compromise
- CVE-2021-44057 (CVSS score: 7.1) – An improper authentication vulnerability in QNAP products managing Photo Station, primary to process compromise
Found this post attention-grabbing? Comply with THN on Facebook, Twitter and LinkedIn to examine far more distinctive content material we write-up.
Some parts of this article are sourced from:
thehackernews.com