CVE-2022-27596: QNAP QTS and QuTS Hero RCE Vulnerability

CVE-2022-27596 Overview

CVE-2022-27596 is a SQL injection vulnerability [CWE-89] affecting QNAP network-attached storage devices running QTS and QuTS hero operating systems. Remote attackers can inject malicious SQL code without authentication or user interaction. QNAP disclosed the issue in security advisory QSA-23-01 and released fixes in QuTS hero h5.0.1.2248 build 20221215 and QTS 5.0.1.2234 build 20221201. The vulnerability carries an EPSS probability of 20.952%, placing it in the 95th percentile of exploitation likelihood.

Critical Impact
Unauthenticated remote attackers can inject SQL commands into vulnerable QNAP NAS devices, potentially leading to data manipulation, disclosure of stored credentials, and broader system compromise.

Affected Products

QNAP QTS (versions prior to 5.0.1.2234 build 20221201)
QNAP QuTS hero (versions prior to h5.0.1.2248 build 20221215)
QNAP NAS appliances exposing the management interface to untrusted networks

Discovery Timeline

2023-01-30 - CVE-2022-27596 published to NVD
2024-11-21 - Last updated in NVD database

Technical Details for CVE-2022-27596

Vulnerability Analysis

The flaw is classified under [CWE-89], indicating improper neutralization of special elements used in an SQL command. An attacker can submit crafted input to a vulnerable component of the QTS or QuTS hero web interface, and the backend constructs SQL queries that incorporate the input without adequate sanitization. The result is execution of attacker-controlled SQL within the device database context.

QNAP's advisory QSA-23-01 confirms remote exploitation without prerequisites such as authentication or user interaction. Successful exploitation can expose stored configuration, manipulate database records, and serve as a pivot point for further compromise of NAS-resident data.

Root Cause

The root cause is the use of unsanitized user-controlled input within SQL query construction. The vulnerable code path concatenates request parameters into SQL statements rather than using parameterized queries or strict input validation. QNAP has not published the exact vulnerable component, but the fix is delivered through firmware updates across both QTS and QuTS hero product lines.

Attack Vector

The attack vector is the network. An attacker reaches the QNAP management interface over HTTP or HTTPS and submits a crafted request containing SQL metacharacters in a parameter the backend trusts. Because the vulnerability requires no privileges and no user interaction, exposed NAS devices are reachable from the public internet through port-forwarding or direct internet exposure. Refer to the QNAP Security Advisory QSA-23-01 for vendor-confirmed exploitation conditions.

Detection Methods for CVE-2022-27596

Indicators of Compromise

Unexpected SQL syntax characters (', --, UNION, SELECT) appearing in QNAP web access logs and reverse-proxy logs
Anomalous outbound connections originating from NAS appliances after receipt of unusual HTTP requests
Newly created administrator accounts or modified user records that do not match change-management records
Modifications to QTS or QuTS hero configuration files outside of scheduled maintenance windows

Detection Strategies

Inspect HTTP and HTTPS traffic destined to QNAP management ports for SQL injection patterns using IDS or WAF signatures
Correlate authentication events on the NAS with source IP geolocation to surface unexpected administrative access
Compare installed firmware versions across the fleet against the fixed builds QTS 5.0.1.2234 and QuTS hero h5.0.1.2248

Monitoring Recommendations

Forward QNAP system, access, and event logs to a centralized log platform for retention and analysis
Alert on first-time external IPs initiating administrative sessions against any NAS device
Monitor for outbound traffic from NAS subnets to non-corporate destinations, which is uncommon during normal operation

How to Mitigate CVE-2022-27596

Immediate Actions Required

Upgrade QTS devices to 5.0.1.2234 build 20221201 or later and QuTS hero devices to h5.0.1.2248 build 20221215 or later
Remove direct internet exposure of QNAP management interfaces and place devices behind a VPN or trusted network segment
Audit administrator accounts and rotate credentials for any device suspected of exposure prior to patching
Review access logs for the period preceding the patch deployment to identify suspicious requests

Patch Information

QNAP released firmware updates resolving CVE-2022-27596 on the dates referenced in advisory QSA-23-01. Administrators apply the update through the Control Panel under System > Firmware Update, or by downloading the firmware image from the QNAP Download Center and applying it manually. Vendor guidance is published in the QNAP Security Advisory QSA-23-01.

Workarounds

Disable remote access features such as myQNAPcloud and UPnP port forwarding until firmware is updated
Restrict access to the QNAP web interface using firewall rules that allow only management subnets
Enable QNAP's built-in Access Protection and IP Auto-Block to limit brute-force and probing activity

bash

# Verify installed QTS/QuTS hero firmware against the fixed builds
ssh admin@<nas-host> 'getcfg System Version; getcfg System "Build Number"'
# Expected QTS:        Version 5.0.1, Build 20221201 or later
# Expected QuTS hero:  Version h5.0.1, Build 20221215 or later