What is CVE-2022-27593?

CVE-2022-27593 is an externally controlled reference to a resource vulnerability that affects QNAP NAS running Photo Station.

How does CVE-2022-27593 impact QNAP NAS running Photo Station?

If exploited, CVE-2022-27593 could allow an attacker to modify system files.

Which versions of QNAP Photo Station are affected by CVE-2022-27593?

QNAP Photo Station versions up to and including 5.4.15 are affected by CVE-2022-27593.

Is QNAP QTS affected by CVE-2022-27593?

QNAP QTS versions 4.2.6, 4.3.3, 4.3.6, 4.5.1 to 4.5.4.2012, and 5.0.0 are not vulnerable to CVE-2022-27593.

How can I fix CVE-2022-27593?

To fix CVE-2022-27593, update to QTS 5.0.1 with Photo Station 6.1.2 or later.

Vulnerability/
CVE-2022-27593

Exploited

critical

CWE

610

8/9/2022

13/9/2022

CVE-2022-27593: QNAP Photo Station Externally Controlled Reference Vulnerability

First published: Thu Sep 08 2022(Updated: )

Certain QNAP NAS running Photo Station with internet exposure contain an externally controlled reference to a resource vulnerability which can allow an attacker to modify system files. This vulnerability was observed being utilized in a Deadbolt ransomware campaign.

Credit: security@qnapsecurity.com.tw

Affected Software	Affected Version	How to fix

QNAP Photo Station	<5.2.14
QNAP QTS	=4.2.6
QNAP Photo Station	<5.4.15
QNAP QTS	=4.3.3
QNAP Photo Station	<5.7.18
QNAP QTS	=4.3.6
QNAP Photo Station	<6.0.22
QNAP QTS	>=4.5.1<=4.5.4.2012
QNAP QTS	=5.0.0
QNAP Photo Station	<6.1.2
QNAP QTS	=5.0.1

Never miss a vulnerability like this again

Reference Links

https://www.qnap.com/en/security-advisory/qsa-22-24

Frequently Asked Questions

What is CVE-2022-27593?
CVE-2022-27593 is an externally controlled reference to a resource vulnerability that affects QNAP NAS running Photo Station.
How does CVE-2022-27593 impact QNAP NAS running Photo Station?
If exploited, CVE-2022-27593 could allow an attacker to modify system files.
Which versions of QNAP Photo Station are affected by CVE-2022-27593?
QNAP Photo Station versions up to and including 5.4.15 are affected by CVE-2022-27593.
Is QNAP QTS affected by CVE-2022-27593?
QNAP QTS versions 4.2.6, 4.3.3, 4.3.6, 4.5.1 to 4.5.4.2012, and 5.0.0 are not vulnerable to CVE-2022-27593.
How can I fix CVE-2022-27593?
To fix CVE-2022-27593, update to QTS 5.0.1 with Photo Station 6.1.2 or later.

agent/author
agent/description
agent/event
agent/first-publish-date
agent/last-modified-date
agent/references
agent/severity
agent/softwarecombine
agent/tags
agent/title
agent/type
agent/weakness
exploited/true
ransomware/true
collector/cisa-known-exploited
source/CISA
agent/software-canonical-lookup
collector/nvd-index
vendor/qnap
canonical/qnap photo station
canonical/qnap qts
version/qnap qts/4.2.6
version/qnap qts/4.3.3
version/qnap qts/4.3.6
version/qnap qts/4.5.1
version/qnap qts/4.5.4.2012
version/qnap qts/5.0.0
version/qnap qts/5.0.1

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co

By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.