Security ID : QSA-24-22

Vulnerability in QVR Smart Client

Release date : September 7, 2024
CVE identifier : CVE-2022-27592
Affected products: QVR Smart Client 2.4.x

Severity

Moderate

Status

Resolved

Summary

An unquoted search path or element vulnerability has been reported to affect QVR Smart Client. If exploited, the vulnerability could allow attackers to execute unauthorized code or commands.

We have already fixed the vulnerability in the following versions:

Affected Product

Fixed Version

QVR Smart Client 2.4.x

QVR Smart Client 2.4.0.0570 and later

(for Windows 10 SP1, Windows 11, and macOS)

Recommendation

To secure your device, we recommend regularly updating your QNAP utilities to the latest versions to benefit from vulnerability fixes. You can check the QNAP Utilities page to see the latest updates available to your device operating system.

Attachment

CVE-2022-27592.json

Acknowledgements: Runzi Zhao, Security Researcher, QI-ANXIN

Revision History:
V1.0 (September 07, 2024) - Published