CVE-2022-27593

An externally controlled reference to a resource vulnerability has been reported to affect QNAP NAS running Photo Station. If exploited, This could allow an attacker to modify system files. We have already fixed the vulnerability in the following versions: QTS 5.0.1: Photo Station 6.1.2 and later QTS 5.0.0/4.5.x: Photo Station 6.0.22 and later QTS 4.3.6: Photo Station 5.7.18 and later QTS 4.3.3: Photo Station 5.4.15 and later QTS 4.2.6: Photo Station 5.2.14 and later

Score

CVSS 3.1 10.0 Critical

Status

Analyzed - security@qnapsecurity.com.tw

Published

2022-09-08

Last modified

2025-10-21

Known exploited (CISA KEV)

since 2022-09-08, action due 2022-09-29: Apply updates per vendor instructions.

Weaknesses

CWE-610

Affected products

• Photo Station (Qnap)
• Photo Station (Qnap Systems Inc.)

References

• https://www.qnap.com/en/security-advisory/qsa-22-24
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-27593