# CVE-2022-27593

An externally controlled reference to a resource vulnerability has been reported to affect QNAP NAS running Photo Station. If exploited, This could allow an attacker to modify system files. We have already fixed the vulnerability in the following versions: QTS 5.0.1: Photo Station 6.1.2 and later QTS 5.0.0/4.5.x: Photo Station 6.0.22 and later QTS 4.3.6: Photo Station 5.7.18 and later QTS 4.3.3: Photo Station 5.4.15 and later QTS 4.2.6: Photo Station 5.2.14 and later

- Page: https://www.vulneraibility.com/cve/CVE-2022-27593
- CVSS: 10.0
- Known exploited: yes, in CISA KEV since 2022-09-08; CISA due date 2022-09-29; known ransomware use
- EPSS: 87.91% (percentile 99.8)
- Detection templates only, no public exploit found: 1 Nuclei template
- CISA SSVC: exploitation active, automatable yes, technical impact partial (assessed 2023-12-22)
- Weakness: CWE-610
- Published: 2022-09-08

## Affected versions

- QNAP Systems Inc. Photo Station: affected < 6.1.2; < 6.0.22; < 5.7.18; < 5.4.15; < 5.2.14

A version outside these ranges is not a statement that it is unaffected.

## References

- [other] https://www.qnap.com/en/security-advisory/qsa-22-24
- [other] https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-27593

---
Summary, impact and action are written by the vulneraibility.com AI analysis pipeline from the CVE record, NVD, CISA and FIRST data; verify against the references.