CVE-2022-27593: QNAP Photo Station Externally Controlled Reference Vulnerability

CVE-2022-27593 · Severity: critical · CVSS 9.1 · Exploited in the wild · Published 2022-09-08

An externally controlled reference to a resource vulnerability in QNAP Photo Station allows remote attackers to modify system files. This vulnerability has been actively exploited in the wild, specifically in Deadbolt ransomware campaigns.

Technologies: QNAP Photo Station. Vendors: QNAP.

Quick answers

Is CVE-2022-27593 exploited in the wild?
Yes. CVE-2022-27593 is known to be exploited in the wild, first recorded on 8 September 2022. Treat it as urgent.
How severe is CVE-2022-27593?
Critical severity, with a CVSS score of 9.1, published 8 September 2022.
Which products and versions are affected?
QNAP Photo Station 6.1.2 (QTS 5.0.1); 6.0.22 (QTS 5.0.0/4.5.x); 5.7.18 (QTS 4.3.6); 5.4.15 (QTS 4.3.3); 5.2.14 (QTS 4.2.6).
Is there a fix for CVE-2022-27593?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2022-27593 attacked?
It is attacked over the network, in a network appliance.
Am I affected by CVE-2022-27593?
Check whether you run QNAP Photo Station. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Affected products

  • QNAP Photo Station 6.1.2 (QTS 5.0.1); 6.0.22 (QTS 5.0.0/4.5.x); 5.7.18 (QTS 4.3.6); 5.4.15 (QTS 4.3.3); 5.2.14 (QTS 4.2.6)

Timeline

  • 2022-09-08: disclosed
  • 2022-09-08: advisory
  • 2022-09-08: kev added: Added to CISA KEV catalog
  • 2022-09-08: exploited: Observed in Deadbolt ransomware campaign

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.