{"id":"CVE-2022-27598","aliases":["EUVD-2022-32099","GHSA-gjq7-hxqp-x7cf"],"status":"published","title":"QTS, QuTS hero, QuTScloud, QVP (QVR Pro appliances)","description":"A vulnerability has been reported to affect QNAP operating systems. If exploited, the out-of-bounds read vulnerability allows remote authenticated administrators to get secret values. The vulnerability affects the following QNAP operating systems: QTS, QuTS hero, QuTScloud, QVP (QVR Pro appliances) We have already fixed the vulnerability in the following versions: QTS 5.0.1.2346 build 20230322 and later QuTS hero h5.0.1.2348 build 20230324 and later","severity":{"version":"3.1","score":2.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N","level":"low","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00658,"percentile":0.51763,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-125"],"published":"2023-03-29T00:00:00Z","modified":"2026-06-17T04:37:20Z","products":[{"vendor":"qnap","product":"qts"},{"vendor":"qnap","product":"quts_hero"},{"vendor":"qnap","product":"qutscloud"},{"vendor":"qnap","product":"qvp-21a_firmware"},{"vendor":"qnap","product":"qvp-41a_firmware"},{"vendor":"qnap","product":"qvp-41b_firmware"},{"vendor":"qnap","product":"qvp-63a_firmware"},{"vendor":"qnap","product":"qvp-63b_firmware"},{"vendor":"qnap","product":"qvp-85a_firmware"},{"vendor":"qnap","product":"qvp-85b_firmware"},{"vendor":"qnap systems inc.","product":"qts"},{"vendor":"qnap systems inc.","product":"quts hero"}],"references":[{"url":"https://www.qnap.com/en/security-advisory/qsa-23-06","tags":["x_transferred","Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-27598"},{"url":"https://www.qnap.com/en/security-advisory/"},{"url":"https://github.com/advisories/GHSA-gjq7-hxqp-x7cf"}],"sources":{"cve":[{"id":"CVE-2022-27598","title":"QTS, QuTS hero, QuTScloud, QVP (QVR Pro appliances)","description":"A vulnerability has been reported to affect QNAP operating systems. If exploited, the out-of-bounds read vulnerability allows remote authenticated administrators to get secret values. The vulnerability affects the following QNAP operating systems: QTS, QuTS hero, QuTScloud, QVP (QVR Pro appliances) We have already fixed the vulnerability in the following versions: QTS 5.0.1.2346 build 20230322 and later QuTS hero h5.0.1.2348 build 20230324 and later","status":"published","published":"2023-03-29T00:00:00Z","modified":"2025-02-12T19:32:03.826Z","cvss":[{"version":"3.1","score":2.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N","level":"low","assessor":"cna"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T14:34:34.250357Z"}],"euvd":[{"id":"EUVD-2022-32099","description":"A vulnerability has been reported to affect QNAP operating systems. If exploited, the out-of-bounds read vulnerability allows remote authenticated administrators to get secret values. The vulnerability affects the following QNAP operating systems: QTS, QuTS hero, QuTScloud, QVP (QVR Pro appliances) We have already fixed the vulnerability in the following versions: QTS 5.0.1.2346 build 20230322 and later QuTS hero h5.0.1.2348 build 20230324 and later","status":"published","published":"2023-03-29T00:00:00Z","modified":"2025-02-12T19:32:03Z","cvss":[{"version":"3.1","score":2.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N","level":"low"}],"updated_at":"2026-11-03T00:03:57.395516Z"}],"ghsa":[{"id":"GHSA-gjq7-hxqp-x7cf","title":"A vulnerability have been reported to affect multiple QNAP operating systems. If exploited, the...","description":"A vulnerability have been reported to affect multiple QNAP operating systems. If exploited, the vulnerability allow remote authenticated users to get secret values. The vulnerabilities affect the following QNAP operating systems: QTS, QuTS hero, QuTScloud, QVP (QVR Pro appliances) We have already fixed the vulnerabilities in the following operating system versions: QTS 5.0.1.2346 build 20230322 and later QuTS hero h5.0.1.2348 build 20230324 and later","status":"published","published":"2023-03-29T09:30:32Z","modified":"2023-04-28T05:08:34Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T14:54:33.975596Z"}],"nvd":[{"id":"CVE-2022-27598","description":"A vulnerability has been reported to affect QNAP operating systems. If exploited, the out-of-bounds read vulnerability allows remote authenticated administrators to get secret values. The vulnerability affects the following QNAP operating systems: QTS, QuTS hero, QuTScloud, QVP (QVR Pro appliances) We have already fixed the vulnerability in the following versions: QTS 5.0.1.2346 build 20230322 and later QuTS hero h5.0.1.2348 build 20230324 and later","status":"published","published":"2023-03-29T07:15:08.613Z","modified":"2026-06-17T04:37:20.067Z","cvss":[{"version":"3.1","score":2.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N","level":"low","assessor":"secondary"},{"version":"3.1","score":2.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N","level":"low","assessor":"primary"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T14:07:37.020555Z"}]}}