CVE-2022-27593

CVE-2022-27593 is a critical-severity (CVSS 10.0) vulnerability in QNAP Photo Station. CISA added it to the Known Exploited Vulnerabilities catalog on September 8, 2022, which means exploitation in the wild has been confirmed; US federal agencies had to remediate it by September 29, 2022. CISA also lists it as known to be used in ransomware campaigns, so it should be prioritised accordingly. QNAP has 11 vulnerabilities in the KEV catalog, 9 of them linked to ransomware.

An externally controlled reference to a resource vulnerability has been reported to affect QNAP NAS running Photo Station. If exploited, This could allow an attacker to modify system files. We have already fixed the vulnerability in the following versions: QTS 5.0.1: Photo Station 6.1.2 and later QTS 5.0.0/4.5.x: Photo Station 6.0.22 and later QTS 4.3.6: Photo Station 5.7.18 and later QTS 4.3.3: Photo Station 5.4.15 and later QTS 4.2.6: Photo Station 5.2.14 and later

CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:H

• https://www.qnap.com/en/security-advisory/qsa-22-24
• https://www.qnap.com/en/security-advisory/qsa-22-24
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-27593