Security ID : QSA-24-22
Vulnerability in QVR Smart Client
Release date : September 7, 2024
CVE identifier : CVE-2022-27592
Affected products: QVR Smart Client 2.4.x
Severity
Moderate
Status
Resolved
Summary
An unquoted search path or element vulnerability has been reported to affect QVR Smart Client. If exploited, the vulnerability could allow attackers to execute unauthorized code or commands.
We have already fixed the vulnerability in the following versions:
| Affected Product | Fixed Version |
| QVR Smart Client 2.4.x |
QVR Smart Client 2.4.0.0570 and later (for Windows 10 SP1, Windows 11, and macOS) |
Recommendation
To secure your device, we recommend regularly updating your QNAP utilities to the latest versions to benefit from vulnerability fixes. You can check the QNAP Utilities page to see the latest updates available to your device operating system.
Attachment
Acknowledgements: Runzi Zhao, Security Researcher, QI-ANXIN
Revision History:
V1.0 (September 07, 2024) - Published
