by Kastro
Paper/Archive/CVE-2022-27593

CVE-2022-27593

QNAP Systems Inc. Photo Station — DeadBolt Ransomware

KEV · due 29 Sepransomware useEPSS 88%public exploitSSVC actCVSS 10.0
critical.is priorityof 100
100
CVSS 10.0 (CNA)10.0 / 10 × 3030.0In CISA KEV+3030.0EPSS percentile 99.8.998 × 2020.0Exploit: SSVC active+1010.0SSVC exploitation: active+1010.0
Description · from the CVE record

An externally controlled reference to a resource vulnerability has been reported to affect QNAP NAS running Photo Station. If exploited, This could allow an attacker to modify system files. We have already fixed the vulnerability in the following versions: QTS 5.0.1: Photo Station 6.1.2 and later QTS 5.0.0/4.5.x: Photo Station 6.0.22 and later QTS 4.3.6: Photo Station 5.7.18 and later QTS 4.3.3: Photo Station 5.4.15 and later QTS 4.2.6: Photo Station 5.2.14 and later

Affected

ProductAffectedFixed inSource
Photo Stationunspecified – < 6.1.26.1.2CNA
Photo Stationunspecified – < 6.0.226.0.22CNA
Photo Stationunspecified – < 6.0.226.0.22CNA
Photo Stationunspecified – < 5.7.185.7.18CNA
Photo Stationunspecified – < 5.4.155.4.15CNA
Photo Stationunspecified – < 5.2.145.2.14CNA

Scores by source

qnap (CNA)10.0CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:H
CISA ADPSSVCExploitation: active · Automatable: yes · Technical impact: partial

References

refqnap.com/en/security-advisory/qsa-22-24refcisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-27593kevcisa.gov/known-exploited-vulnerabilities-catalog