CVEvulnerability

CVE-2022-27593

9.1 CRITICAL Known exploited Published 2022-09-08 Modified 2026-06-17 Official page ↗

CISA Known Exploited Vulnerability

QNAP Photo Station Externally Controlled Reference Vulnerability — QNAP Photo Station

Certain QNAP NAS running Photo Station with internet exposure contain an externally controlled reference to a resource vulnerability which can allow an attacker to modify system files. This vulnerability was observed being utilized in a Deadbolt ransomware campaign.

Added to KEV: 2022-09-08
Remediation due: 2022-09-29
Ransomware use: Known
Required action: Apply updates per vendor instructions.
Notes: https://www.qnap.com/en/security-advisory/qsa-22-24; https://nvd.nist.gov/vuln/detail/CVE-2022-27593

Status: Analyzed
Published: 2022-09-08
Last modified: 2026-06-17
Assigner: [email protected]
CVSS 3.1 ([email protected]): 10.0 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:H
CVSS 3.1 ([email protected]): 9.1 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
Weaknesses: CWE-610

Description

An externally controlled reference to a resource vulnerability has been reported to affect QNAP NAS running Photo Station. If exploited, This could allow an attacker to modify system files. We have already fixed the vulnerability in the following versions: QTS 5.0.1: Photo Station 6.1.2 and later QTS 5.0.0/4.5.x: Photo Station 6.0.22 and later QTS 4.3.6: Photo Station 5.7.18 and later QTS 4.3.3: Photo Station 5.4.15 and later QTS 4.2.6: Photo Station 5.2.14 and later

Affected configurations

• qnap photo station (< 5.2.14) • qnap photo station (< 5.4.15) • qnap photo station (< 5.7.18) • qnap photo station (< 6.0.22) • qnap photo station (< 6.1.2)

Weakness · CWE (1)

CWE-610 Externally Controlled Reference to a Resource in Another Sphere weakness

References