{"id":"CVE-2022-27593","kind":"vulnerability","aliases":["CVE-2022-27593"],"related":[],"title":"qnap photo station: An externally controlled reference to a resource vulnerability has been reported to affect QNAP NAS running Photo…","description":"An externally controlled reference to a resource vulnerability has been reported to affect QNAP NAS running Photo Station. If exploited, This could allow an attacker to modify system files. We have already fixed the vulnerability in the following versions: QTS 5.0.1: Photo Station 6.1.2 and later QTS 5.0.0/4.5.x: Photo Station 6.0.22 and later QTS 4.3.6: Photo Station 5.7.18 and later QTS 4.3.3: Photo Station 5.4.15 and later QTS 4.2.6: Photo Station 5.2.14 and later","summary":"QNAP Photo Station on certain QNAP NAS devices has an externally controlled reference flaw that lets an internet attacker modify system files. It has been used in Deadbolt ransomware campaigns.","severity":"critical","cvss":10.0,"epss":0.87908,"exploited":true,"exploited_at":"2022-09-08T00:00:00+00:00","products":[{"name":"qnap photo station","fixed":["5.2.14"],"affected":"< 5.2.14","ecosystem":"vendor"},{"name":"qnap photo station","fixed":["5.4.15"],"affected":"< 5.4.15","ecosystem":"vendor"},{"name":"qnap photo station","fixed":["5.7.18"],"affected":"< 5.7.18","ecosystem":"vendor"},{"name":"qnap photo station","fixed":["6.0.22"],"affected":"< 6.0.22","ecosystem":"vendor"},{"name":"qnap photo station","fixed":["6.1.2"],"affected":"< 6.1.2","ecosystem":"vendor"},{"name":"QNAP Photo Station","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["exploited","infrastructure","nas","photo-station","qnap","ransomware","self-hosted"],"not_affected_if":["no-internet-exposure","photo-station-not-installed"],"how_to_check":null,"fix":"Apply the QNAP update for Photo Station per vendor instructions; the sources do not name the fixed version.","status":"open","published_at":"2022-09-08T00:00:00+00:00","first_seen_at":"2026-10-23T19:11:52+00:00","triaged_at":"2026-10-23T21:10:42+00:00","updated_at":"2026-10-24T00:09:51+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-23T21:10:42Z","model":"claude-haiku-5-5","output":{"fix":"Apply the QNAP update for Photo Station per vendor instructions; the sources do not name the fixed version.","reach":"internet","impact":"high","summary":"QNAP Photo Station on certain QNAP NAS devices has an externally controlled reference flaw that lets an internet attacker modify system files. It has been used in Deadbolt ransomware campaigns.","category":"infrastructure","who_cares":["qnap","nas","photo-station","self-hosted"],"confidence":0.6,"needs_auth":"unknown","worst_case":"attacker modifies system files on the NAS, enabling ransomware deployment","analyst_note":"Find the QNAP security advisory for CVE-2022-27593 to get affected and fixed versions and a how-to-check step; the sources only link CISA KEV and EPSS.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["no-internet-exposure","photo-station-not-installed"],"user_interaction":"unknown","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.00047,"input_tokens":2872,"output_tokens":366,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2022':22A,25A '-27593':23A,26A '/4.5.x':134C '4.2.6':155C '4.3.3':148C '4.3.6':141C '5.0.0':133C '5.0.1':126C '5.2.14':158C '5.4.15':151C '5.7.18':144C '6.0.22':137C '6.1.2':129C 'affect':16A,98C 'allow':108C 'alreadi':117C 'attack':74B,110C 'campaign':85B 'certain':60B 'control':6A,67B,88C 'could':107C 'cve':21A,24A 'deadbolt':83B 'devic':63B 'exploit':45B,105C 'extern':5A,66B,87C 'file':77B,114C 'fix':118C 'flaw':69B 'follow':123C 'host':55B 'infrastructur':46B 'internet':73B 'later':131C,139C,146C,153C,160C 'let':71B 'modifi':75B,112C 'nas':18A,47B,62B,100C 'photo':2A,20A,28A,31A,34A,37A,40A,43A,49B,57B,102C,127C,135C,142C,149C,156C 'photo-st':48B 'qnap':1A,17A,27A,30A,33A,36A,39A,42A,51B,56B,61B,99C 'qts':125C,132C,140C,147C,154C 'ransomwar':52B,84B 'refer':7A,68B,89C 'report':14A,96C 'resourc':10A,92C 'run':19A,101C 'self':54B 'self-host':53B 'station':3A,29A,32A,35A,38A,41A,44A,50B,58B,103C,128C,136C,143C,150C,157C 'system':76B,113C 'use':81B 'version':124C 'vulner':11A,93C,120C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2022-09-08T00:00:00+00:00","kev":{"dateAdded":"2022-09-08","dueDate":"2022-09-29","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"Known"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:H","cvss_by":"security@qnapsecurity.com.tw","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2022-27593","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2022-27593","severity":null,"published_at":"2022-09-08T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:52+00:00","fetched_at":"2026-10-25T11:39:16+00:00","note":null},{"source":"epss","external_id":"CVE-2022-27593","url":"https://api.first.org/data/v1/epss?cve=CVE-2022-27593","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:45+00:00","fetched_at":"2026-10-23T19:13:45+00:00","note":null},{"source":"nvd","external_id":"CVE-2022-27593","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-27593","severity":null,"published_at":"2022-09-08T11:15:19+00:00","modified_at":"2026-06-17T04:37:19+00:00","first_seen_at":"2026-10-23T22:29:04+00:00","fetched_at":"2026-10-23T22:29:04+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}