QNAP Addressed Vulnerabilities in QVR systems

QNAP has addressed multiple vulnerabilities, in its products, tracked as  CVE-2022-27588 with CVSS 9.8 that could be exploited by a remote attacker to execute arbitrary commands on vulnerable QVR systems.

QNAP QVR is a video surveillance solution of the Taiwanese vendor which is hosted on its NAS devices and doesn’t require any extra software.

The company addressed the issue with the release of QVR 5.1.6 build 20220401.

Below is the list of the other issues addressed by the vendor:

CVE-2021-44057: A high severity vulnerability in QNAP NAS Photo Station that could allow attackers to compromise the security of the system.

CVE-2021-44051: A high-severity command injection flaw in QTS, QuTS hero, and QuTScloud.

CVE-2021-44052: A high-severity link resolution flaw in QTS, QuTS hero, and QuTScloud.

CVE-2021-44053: A High-severity cross-site scripting (XSS) flaw in QTS, QuTS hero, and QuTScloud.

CVE-2021-44054: A high-severity open-redirect vulnerability in QTS, QuTS hero, and QuTScloud.

CVE-2021-38693: A medium Severity Path Traversal Vulnerability in thttpd in QTS, QuTS hero, and QuTScloud.

CVE-2021-44055&CVE-2021-44056: A medium severity vulnerabilities affecting QNAP NAS running certain versions of Video Station. If exploited, these vulnerabilities allow remote attackers to access sensitive data, perform unauthorized actions, and compromise the security of the system.