QNAP Photo Station Externally Controlled Reference Vulnerability

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

1. Sep 8, 2022 · Catalog

   Detected

   An externally controlled reference to a resource vulnerability has been reported to affect QNAP NAS running Photo Station. If exploited, This could allow an attacker to modify system files. We have already fixed the vulnerability in the following versions: QTS 5.0.1: Photo Station 6.1.2 and later QTS 5.0.0/4.5.x: Photo Station 6.0.22 and later QTS 4.3.6: Photo Station 5.7.18 and later QTS 4.3.3: P

2. Sep 8, 2022 · CISA KEV

   Known exploited

   Apply updates per vendor instructions.

3. Sep 29, 2022 · CISA KEV

   Remediation due

   Apply updates per vendor instructions.

4. Jun 16, 2026 · Catalog

   Updated

   An externally controlled reference to a resource vulnerability has been reported to affect QNAP NAS running Photo Station. If exploited, This could allow an attacker to modify system files. We have already fixed the vulnerability in the following versions: QTS 5.0.1: Photo Station 6.1.2 and later QTS 5.0.0/4.5.x: Photo Station 6.0.22 and later QTS 4.3.6: Photo Station 5.7.18 and later QTS 4.3.3: P

Affected

• cpe qnap/photo stationversion unspecified
• vendor QNAP Photo Stationversion unspecified

Sources

• CISA KEVConfirmed exploitationCVE-2022-27593

  Certain QNAP NAS running Photo Station with internet exposure contain an externally controlled reference to a resource vulnerability which can allow an attacker to modify system files. This vulnerability was observed being utilized in a Deadbolt ransomware campaign.

  cisa.gov
• CVE.orgVulnerability recordCVE-2022-27593

  Official CVE identifier

  cve.org
• FIRST EPSSExploitation probabilityCVE-2022-27593

  30-day exploitation probability 87.9%

  first.org
• NIST NVDVulnerability recordCVE-2022-27593

  An externally controlled reference to a resource vulnerability has been reported to affect QNAP NAS running Photo Station. If exploited, This could allow an attacker to modify system files. We have already fixed the vulnerability in the following versions: QTS 5.0.1: Photo Statio

  nvd.nist.gov

References

• CISA note · nvd.nist.gov
• US Government Resource · cisa.gov
• CISA note · qnap.com