CVE-2022-27593

critical · 10Actively exploited

On the CISA Known Exploited Vulnerabilities catalog

Apply updates per vendor instructions.

Added 2022-09-08Remediation due 2022-09-29

A public exploit / detection template exists

Weaponised detection is publicly available, which meaningfully raises real-world risk regardless of CVSS. nuclei-templates →

An externally controlled reference to a resource vulnerability has been reported to affect QNAP NAS running Photo Station. If exploited, This could allow an attacker to modify system files. We have already fixed the vulnerability in the following versions: QTS 5.0.1: Photo Station 6.1.2 and later QTS 5.0.0/4.5.x: Photo Station 6.0.22 and later QTS 4.3.6: Photo Station 5.7.18 and later QTS 4.3.3: Photo Station 5.4.15 and later QTS 4.2.6: Photo Station 5.2.14 and later

CVSS

87.9%

EPSS (exploit prob.)

100th

EPSS percentile

2022-09-08

Published

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:H

Weaknesses

CWE-610

Affected products

Vendor	Product	Affected versions
qnap	photo_station	< 5.2.14
qnap	qts	4.2.6
qnap	photo_station	< 5.4.15
qnap	qts	4.3.3
qnap	photo_station	< 5.7.18
qnap	qts	4.3.6
qnap	photo_station	< 6.0.22
qnap	qts	>= 4.5.1, <= 4.5.4.2012
qnap	qts	5.0.0
qnap	photo_station	< 6.1.2
qnap	qts	5.0.1

Check a specific version with /api/v1/cve/match.

References

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2022-27593