{"schemaVersion":3,"id":"CVE-2022-27593","aliases":[],"status":"published","duplicateOf":null,"title":"QNAP Photo Station Externally Controlled Reference Vulnerability","description":"An externally controlled reference to a resource vulnerability has been reported to affect QNAP NAS running Photo Station. If exploited, This could allow an attacker to modify system files. We have already fixed the vulnerability in the following versions: QTS 5.0.1: Photo Station 6.1.2 and later QTS 5.0.0/4.5.x: Photo Station 6.0.22 and later QTS 4.3.6: Photo Station 5.7.18 and later QTS 4.3.3: Photo Station 5.4.15 and later QTS 4.2.6: Photo Station 5.2.14 and later","dates":{"published":"2022-09-08T11:00:15.069Z","modified":"2025-10-21T23:15:35.935Z","reserved":null,"kevAdded":["2022-09-08T00:00:00.000Z"],"kevDue":["2022-09-29T00:00:00.000Z"]},"cvss":{"headline":{"score":10,"severity":"critical","version":"3.1","versionLabel":"v3.1","source":"CVE.org","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:H","computed":false,"selection":"backend-summary"},"metrics":[{"version":"3.1","versionLabel":"v3.1","source":"CVE.org","score":10,"severity":"critical","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:H","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"NVD","score":9.1,"severity":"critical","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.87908,"percentile":0.99765,"severity":"critical","asOf":"2026-10-20T00:00:00.000Z","change":{"pp":0,"baselineDate":"2026-09-20T00:00:00.000Z","baselineScore":0.87908},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.87908,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.87908,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.87908,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.87908,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.87908,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.87908,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.87908,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.87908,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.87908,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.87908,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.87908,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.87908,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.87908,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.87908,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.87908,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.87908,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.87908,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.87908,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.87908,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.87908,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.87908,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.87908,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.87908,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.87908,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.87908,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.87908,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.87908,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.87908,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.87908,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.87908,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.87908,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.87908,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.87908,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.87908,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.87908,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.87908,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.87908,"percentile":0.99765}],"last30":[{"date":"2026-09-20T00:00:00.000Z","score":0.87908,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.87908,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.87908,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.87908,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.87908,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.87908,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.87908,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.87908,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.87908,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.87908,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.87908,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.87908,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.87908,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.87908,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.87908,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.87908,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.87908,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.87908,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.87908,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.87908,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.87908,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.87908,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.87908,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.87908,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.87908,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.87908,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.87908,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.87908,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.87908,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.87908,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.87908,"percentile":0.99765}]},"kev":{"state":"listed","entries":[{"source":"cisa","sourceLabel":"CISA","dateAdded":"2022-09-08T00:00:00.000Z","dueDate":"2022-09-29T00:00:00.000Z","requiredAction":"Apply updates per vendor instructions.","name":"QNAP Photo Station Externally Controlled Reference Vulnerability","description":"Certain QNAP NAS running Photo Station with internet exposure contain an externally controlled reference to a resource vulnerability which can allow an attacker to modify system files. This vulnerability was observed being utilized in a Deadbolt ransomware campaign.","notes":[{"type":"url","href":"https://www.qnap.com/en/security-advisory/qsa-22-24","label":"www.qnap.com/en/security-advisory/qsa-22-24"},{"type":"url","href":"https://nvd.nist.gov/vuln/detail/CVE-2022-27593","label":"nvd.nist.gov/vuln/detail/CVE-2022-27593"}],"vendor":"QNAP","product":"Photo Station","ransomware":true,"ransomwareUse":"Known","exploitationType":null}],"listedCount":1,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":true,"entry":{"source":"cisa","sourceLabel":"CISA","dateAdded":"2022-09-08T00:00:00.000Z","dueDate":"2022-09-29T00:00:00.000Z","requiredAction":"Apply updates per vendor instructions.","name":"QNAP Photo Station Externally Controlled Reference Vulnerability","description":"Certain QNAP NAS running Photo Station with internet exposure contain an externally controlled reference to a resource vulnerability which can allow an attacker to modify system files. This vulnerability was observed being utilized in a Deadbolt ransomware campaign.","notes":[{"type":"url","href":"https://www.qnap.com/en/security-advisory/qsa-22-24","label":"www.qnap.com/en/security-advisory/qsa-22-24"},{"type":"url","href":"https://nvd.nist.gov/vuln/detail/CVE-2022-27593","label":"nvd.nist.gov/vuln/detail/CVE-2022-27593"}],"vendor":"QNAP","product":"Photo Station","ransomware":true,"ransomwareUse":"Known","exploitationType":null}},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"known","sources":["cisa"]},"exploits":[],"exploitCount":0,"weaknesses":[{"id":"CWE-610","name":"Externally Controlled Reference to a Resource in Another Sphere","description":"The product uses an externally controlled name or reference that resolves to a resource that is outside of the intended control sphere.","type":"weakness","status":"Draft","abstraction":"Class","likelihoodOfExploit":null,"url":"https://cwe.mitre.org/data/definitions/610.html"}],"affected":[{"vendor":"qnap systems inc.","product":"photo station","name":"Photo Station","label":"photo station","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≥ unspecified, < 6.1.2","noFixRecorded":false,"fixedIn":null},{"text":"≥ unspecified, < 6.0.22","noFixRecorded":false,"fixedIn":null},{"text":"≥ unspecified, < 5.7.18","noFixRecorded":false,"fixedIn":null},{"text":"≥ unspecified, < 5.4.15","noFixRecorded":false,"fixedIn":null},{"text":"≥ unspecified, < 5.2.14","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ unspecified, < 6.1.2 | ≥ unspecified, < 6.0.22 | ≥ unspecified, < 5.7.18 | ≥ unspecified, < 5.4.15 | ≥ unspecified, < 5.2.14","eol":null,"hubHref":"/vendor/qnap_systems_inc/photo_station"},{"vendor":"qnap","product":"photo_station","name":"Photo Station","label":"photo_station","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"< 5.2.14","noFixRecorded":false,"fixedIn":null},{"text":"< 5.4.15","noFixRecorded":false,"fixedIn":null},{"text":"< 5.7.18","noFixRecorded":false,"fixedIn":null},{"text":"< 6.0.22","noFixRecorded":false,"fixedIn":null},{"text":"< 6.1.2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 5.2.14 | < 5.4.15 | < 5.7.18 | < 6.0.22 | < 6.1.2","eol":null,"hubHref":"/vendor/qnap/photo_station"}],"affectedCount":2,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://www.qnap.com/en/security-advisory/qsa-22-24","label":"www.qnap.com/en/security-advisory/qsa-22-24","hostname":"www.qnap.com","tags":["X Refsource MISC","Vendor Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-27593","label":"www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-27593","hostname":"www.cisa.gov","tags":["Government Resource","US Government Resource"]}],"lineage":{"upstream":[],"downstream":[],"duplicates":[],"related":[]},"timeline":[{"kind":"published","date":"2022-09-08T11:00:15.069Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"kev-added","date":"2022-09-08T00:00:00.000Z","label":"Added to CISA KEV","detail":"QNAP Photo Station Externally Controlled Reference Vulnerability","source":"cisa"},{"kind":"kev-due","date":"2022-09-29T00:00:00.000Z","label":"CISA remediation due","detail":"Apply updates per vendor instructions.","source":"cisa"},{"kind":"modified","date":"2025-10-21T23:15:35.935Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":90,"level":"critical","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-21T09:03:01.372Z","stale":false,"partial":false}}