Actively exploited in the wild
QNAP Photo Station Externally Controlled Reference Vulnerability
QNAP - Photo Station · Listed in the CISA KEV since 2022-09-08. This indicates confirmed attacks in production environments.
Required action: Apply updates per vendor instructions.
CVE-2022-27593
CriticalCVSS 10.0KEVSummary
An externally controlled reference to a resource vulnerability has been reported to affect QNAP NAS running Photo Station. If exploited, this could allow an attacker to modify system files. The vulnerability has been fixed in specific versions of Photo Station for various QTS versions.
Risk Assessment
An attacker could modify system files on the QNAP NAS, potentially leading to system corruption or further privilege escalation. This could result in loss of data integrity and service availability.
Recommendation
Update Photo Station to version 6.1.2 (QTS 5.0.1), 6.0.22 (QTS 5.0.0/4.5.x), 5.7.18 (QTS 4.3.6), 5.4.15 (QTS 4.3.3), or 5.2.14 (QTS 4.2.6) depending on your QTS version. Also restrict Internet access to Photo Station.
Other vulnerabilities in QNAP Photo Station
See all- CVE-2019-7195CriticalActively exploited
This external control of file name or path vulnerability allows remote attackers to access or modify system files. To fix the vulnerability, QNAP recommend updating Photo Station to their latest versions.
- CVE-2019-7194CriticalActively exploited
This external control of file name or path vulnerability allows remote attackers to access or modify system files. To fix the vulnerability, QNAP recommend updating Photo Station to their latest versions.
- CVE-2019-7192CriticalActively exploited
This improper access control vulnerability allows remote attackers to gain unauthorized access to the system. To fix these vulnerabilities, QNAP recommend updating Photo Station to their latest versions.
Original NVD description (English source)
An externally controlled reference to a resource vulnerability has been reported to affect QNAP NAS running Photo Station. If exploited, This could allow an attacker to modify system files. We have already fixed the vulnerability in the following versions: QTS 5.0.1: Photo Station 6.1.2 and later QTS 5.0.0/4.5.x: Photo Station 6.0.22 and later QTS 4.3.6: Photo Station 5.7.18 and later QTS 4.3.3: Photo Station 5.4.15 and later QTS 4.2.6: Photo Station 5.2.14 and later