How severe is CVE-2022-27600?

CVE-2022-27600 has a CVSS 3.x base score of 6.8, rated medium severity. It is exploitable over network with high attack complexity, requires no privileges and no user interaction. Impact on confidentiality is none, integrity none, and availability high.

Is CVE-2022-27600 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (44th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2022-27600?

CVE-2022-27600 primarily affects Qnap Qts. In total, 7 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.

How do I fix CVE-2022-27600?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

Does CVE-2022-27600 have an EU (EUVD) identifier?

Yes. CVE-2022-27600 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2022-32101.

When was CVE-2022-27600 published?

CVE-2022-27600 was published on 2024-12-19 and last updated on 2026-06-17.

CVE-2022-27600

CVE-2022-27600 is a medium-severity vulnerability in Qnap Qts with a CVSS 3.x base score of 6.8. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-400.

Key facts

Severity: Medium (CVSS 3.x base score 6.8)
EPSS exploit prediction: 1% (44th percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2022-32101
Weakness: CWE-400
Affected product: Qnap Qts
Published: 2024-12-19
Last modified: 2026-06-17

Description

An uncontrolled resource consumption vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote attackers to launch a denial-of-service (DoS) attack. We have already fixed the vulnerability in the following versions: QTS 5.0.1.2277 and later QTS 4.5.4.2280 build 20230112 and later QuTS hero h5.0.1.2277 build 20230112 and later QuTS hero h4.5.4.2374 build 20230417 and later QuTScloud c5.0.1.2374 and later

Frequently asked questions

What is CVE-2022-27600?: An uncontrolled resource consumption vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote attackers to launch a denial-of-service (DoS) attack. We have already fixed the vulnerability in the following versions: QTS 5.0.1.2277 and later QTS 4.5.4.2280 build 20230112 and later QuTS hero h5.0.1.2277 build 20230112 and later QuTS hero h4.5.4.2374 build 20230417 and later QuTScloud c5.0.1.2374 and later
How severe is CVE-2022-27600?: CVE-2022-27600 has a CVSS 3.x base score of 6.8, rated medium severity. It is exploitable over network with high attack complexity, requires no privileges and no user interaction. Impact on confidentiality is none, integrity none, and availability high.
Is CVE-2022-27600 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (44th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2022-27600?: CVE-2022-27600 primarily affects Qnap Qts. In total, 7 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
How do I fix CVE-2022-27600?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
Does CVE-2022-27600 have an EU (EUVD) identifier?: Yes. CVE-2022-27600 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2022-32101.
When was CVE-2022-27600 published?: CVE-2022-27600 was published on 2024-12-19 and last updated on 2026-06-17.

References

https://www.qnap.com/en/security-advisory/qsa-23-09

Affected products (7)

cpe:2.3:o:qnap:qts:*:*:*:*:*:*:*:*
cpe:2.3:o:qnap:qts:4.5.4.2280:-:*:*:*:*:*:*
cpe:2.3:o:qnap:qts:5.0.1.2277:-:*:*:*:*:*:*
cpe:2.3:o:qnap:quts_hero:*:*:*:*:*:*:*:*
cpe:2.3:o:qnap:quts_hero:h4.5.4.2374:-:*:*:*:*:*:*
cpe:2.3:o:qnap:quts_hero:h5.0.1.2277:-:*:*:*:*:*:*
cpe:2.3:o:qnap:qutscloud:*:*:*:*:*:*:*:*

More vulnerabilities in Qnap Qts

CVE-2024-32766 — Critical (CVSS 10.0): An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited,…
CVE-2017-7876 — Critical (CVSS 10.0): This command injection vulnerability in QTS allows attackers to run arbitrary commands in the compromised application.…
CVE-2025-66276 — Critical (CVSS 9.8): QuTS hero is not affected. We have already fixed the vulnerability in the following version: QTS 5.2.7.3256 build…
CVE-2025-66277 — Critical (CVSS 9.8): A link following vulnerability has been reported to affect several QNAP operating system versions. The remote attackers…
CVE-2025-62849 — Critical (CVSS 9.8): An SQL injection vulnerability has been reported to affect several QNAP operating system versions. The remote attackers…
CVE-2025-59385 — Critical (CVSS 9.8): An authentication bypass by spoofing vulnerability has been reported to affect several QNAP operating system versions.…

All CVEs affecting Qnap Qts →

Other CWE-400 (Uncontrolled Resource Consumption) vulnerabilities

CVE-2026-46775 — Critical (CVSS 9.9): Vulnerability in Oracle REST Data Services (component: Core). Supported versions that are affected are 24.2.0-26.1.0.…
CVE-2025-61303 — Critical (CVSS 9.8): Hatching Triage Sandbox Windows 10 build 2004 (2025-08-14) and Windows 10 LTSC 2021(2025-08-14) contains a…
CVE-2025-43193 — Critical (CVSS 9.8): The issue was addressed with improved memory handling. This issue is fixed in macOS Sequoia 15.6, macOS Sonoma 14.7.7,…
CVE-2025-24269 — Critical (CVSS 9.8): The issue was addressed with improved memory handling. This issue is fixed in macOS Sequoia 15.4. An app may be able to…
CVE-2025-24264 — Critical (CVSS 9.8): The issue was addressed with improved memory handling. This issue is fixed in Safari 18.4, iOS 18.4 and iPadOS 18.4,…
CVE-2025-24260 — Critical (CVSS 9.8): The issue was addressed with improved memory handling. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.5,…

Browse all CWE-400 (Uncontrolled Resource Consumption) vulnerabilities →