Vulnerability record · CVE-2022-27593 · published 8 September 2022
CVE-2022-27593: QNAP Photo Station external resource reference allows system file modification
Qnap · Photo Station
QNAP Photo Station on NAS devices contains an externally controlled reference to a resource flaw (CWE-610) that lets an attacker modify system files. The vendor has released fixed Photo Station versions across multiple QTS branches. Because the flaw is network-reachable without authentication and is listed in CISA KEV with known ransomware use, it is a serious risk to unpatched NAS deployments.
Description
An externally controlled reference to a resource vulnerability has been reported to affect QNAP NAS running Photo Station. If exploited, This could allow an attacker to modify system files. We have already fixed the vulnerability in the following versions: QTS 5.0.1: Photo Station 6.1.2 and later QTS 5.0.0/4.5.x: Photo Station 6.0.22 and later QTS 4.3.6: Photo Station 5.7.18 and later QTS 4.3.3: Photo Station 5.4.15 and later QTS 4.2.6: Photo Station 5.2.14 and later
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
Automated analysis
critical priorityCVSS 9.1, unauthenticated network reachability, CISA KEV listing with known ransomware use, and very high EPSS probability make this an urgent patch target.
What it is
QNAP Photo Station on NAS devices contains an externally controlled reference to a resource flaw (CWE-610) that lets an attacker modify system files. The vendor has released fixed Photo Station versions across multiple QTS branches. Because the flaw is network-reachable without authentication and is listed in CISA KEV with known ransomware use, it is a serious risk to unpatched NAS deployments.
Impact
An attacker can modify system files on the NAS, which can undermine device integrity and enable follow-on compromise such as persistence or ransomware deployment. The CVSS vector shows high integrity and availability impact with no confidentiality impact.
Attack surface
Reachable over the network via the Photo Station service with no authentication or user interaction required (AV:N/AC:L/PR:N/UI:N). Any internet- or LAN-exposed Photo Station instance is a candidate target.
Exploitation
Listed in CISA KEV since 2022-09-08 with known ransomware campaign use, and EPSS 30-day probability is 0.879 (99.8th percentile), indicating active exploitation is likely. References are vendor advisory and US government catalog entries only.
What to do
- Update Photo Station to the fixed version for your QTS branch: 6.1.2 (QTS 5.0.1), 6.0.22 (QTS 5.0.0/4.5.x), 5.7.18 (QTS 4.3.6), 5.4.15 (QTS 4.3.3), or 5.2.14 (QTS 4.2.6).
- If patching is not immediately possible, disable or remove Photo Station and block external access to it.
- Restrict NAS management and application interfaces from the public internet; place them behind VPN or firewall allowlists.
- Back up NAS data and system configuration offline, and verify backups are restorable.
- Monitor QNAP security advisories for follow-up fixes and re-check exposure after patching.
Detection
- Audit Photo Station versions on all QNAP NAS assets and flag any below the fixed versions listed in the vendor advisory.
- Review Photo Station and web server logs for unexpected requests or file-write activity targeting system paths.
- Monitor for unauthorized changes to system files on NAS devices using file integrity monitoring.
- Watch for ransomware indicators or unusual process activity on NAS hosts, given KEV-listed ransomware use.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Exploitation in the wild
CISA added CVE-2022-27593 to the Known Exploited Vulnerabilities catalog on 8 September 2022 as "QNAP Photo Station Externally Controlled Reference Vulnerability". CISA reports known use in ransomware campaigns. Required action: Apply updates per vendor instructions. Federal deadline 29 September 2022.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
| Link | Tags |
|---|---|
| https://www.qnap.com/en/security-advisory/qsa-22-24 | Vendor Advisory |
| https://www.qnap.com/en/security-advisory/qsa-22-24 | Vendor Advisory |
| https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-27593 | US Government Resource |
Track CVE-2022-27593 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2022-27593), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
