Read the docs
TI-2022-10579 Aliases CVE-2022-27588GHSA-8cr8-x534-x73j

Vulnerability in QVR

Priority MEDIUM 45CWE-77Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-77.

Summary

We have already fixed this vulnerability in the following versions of QVR: QVR 5.1.6 build 20220401 and later

Why it matters now

EPSS 0.01362 71st percentileScored 2026-11-07
Fix Fixed QVR (QNAP Systems Inc.): 5.1.6 build 20220401

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
QNAPQVRbefore 5.1.6 build 202204015.1.6 build 20220401Patch availableCNA
  • QVR VendorQNAP Affected before 5.1.6 build 20220401 Fixed in 5.1.6 build 20220401 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:qnap:qvr:*:*:*:*:*:*:*:*up to 5.1.6VulnerableQNAP
  • cpe:2.3:a:qnap:qvr:*:*:*:*:*:*:*:* Versions up to 5.1.6 Vulnerable ·QNAP

Remediation

  • Fix · CNA QVR (QNAP Systems Inc.) Fixed in 5.1.6 build 20220401

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-27588
  2. 2026-10-03 Alias added: GHSA-8cr8-x534-x73j

References

Advisory 1

  • TI-2025-32893 Improper authentication in QNAP VioStor CVSS 4.0CRITICAL 9.3
  • TI-2021-16256 Command Injection Vulnerability in VioStor CVSS 3.1CRITICAL 9.8
  • TI-2021-13392 Command Injection Vulnerability in QVR CVSS 3.1CRITICAL 9.8
  • TI-2021-13391 Command Injection Vulnerability in QVR CVSS 3.1CRITICAL 9.8
  • TI-2021-13389 Command Injection Vulnerability in QVR CVSS 3.1CRITICAL 9.8
  • TI-2021-16257 Improper Authentication Vulnerability in VioStor CVSS 3.1HIGH 8.8
See all 9 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences