CVE-2022-27593
QNAP Photo Station Externally Controlled Reference Vulnerability
Description
CVE-2022-27593 is an externally controlled reference vulnerability in QNAP Photo Station that allows a remote attacker to modify system files on internet-exposed QNAP NAS devices. This vulnerability was actively exploited in the DeadBolt ransomware campaign that targeted thousands of QNAP devices worldwide. With an EPSS score of 92.96% (99.78th percentile), this is one of the most actively exploited QNAP vulnerabilities. CISA added CVE-2022-27593 to the KEV catalog on September 8, 2022, and it has been confirmed as used in ransomware attacks.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:HOpen in CalculatorCWEs
Affected Products
| Vendor | Product | Version |
|---|---|---|
| qnap | photo station | < 5.2.14; < 5.4.15; < 5.7.18; < 6.0.22; < 6.1.2 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
References
- https://www.qnap.com/en/security-advisory/qsa-22-24(Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-27593(US Government Resource)
Weakness Type
CWE-610: Externally Controlled Reference to a Resource in Another Sphere
CVE-2022-27593 exploits an externally controlled reference vulnerability in QNAP Photo Station. The application allows external input to reference and modify system resources that should be protected, enabling attackers to manipulate system files on the NAS device.
Learn more: CWE-610 — Externally Controlled Reference to a Resource in Another Sphere
Impact Analysis
CVE-2022-27593 allows remote attackers to modify system files on QNAP NAS devices running Photo Station, which are frequently exposed directly to the internet. Confidentiality is critically impacted as NAS devices typically store an organization's most valuable data including documents, backups, and media. Integrity is compromised through arbitrary system file modification, which was leveraged by the DeadBolt ransomware to encrypt all stored files. Availability is devastated in ransomware scenarios where all data becomes inaccessible. The EPSS score of 92.96% confirms widespread exploitation, and the confirmed ransomware usage makes this a top-priority vulnerability for any organization running internet-facing QNAP NAS devices.
Exploit Maturity
CISA confirmed active exploitation of CVE-2022-27593 and added it to the KEV catalog on September 8, 2022, with a remediation deadline of September 29, 2022. The vulnerability has been confirmed as used in the DeadBolt ransomware campaign, which targeted thousands of QNAP NAS devices globally. The EPSS score of 92.96% (99.78th percentile) indicates near-certain exploitation activity. The DeadBolt ransomware gang specifically targeted QNAP devices through this vulnerability, encrypting data and demanding ransom payments in Bitcoin.
Remediation
- Update QNAP Photo Station: Upgrade Photo Station to the latest patched version or switch to QuMagie, which QNAP recommends as a replacement.
- Remove internet exposure: Do not expose QNAP NAS devices directly to the internet. Use a VPN or QNAP's myQNAPcloud Link for secure remote access instead.
- Disable Photo Station if not needed: If Photo Station is not actively used, disable or uninstall it to eliminate the attack surface.
- Check for ransomware indicators: Verify that files on the NAS have not been encrypted, and check for the presence of DeadBolt ransom notes.
- Implement backup strategy: Maintain offline backups of NAS data following the 3-2-1 backup rule to protect against ransomware data loss.
Technical Details
CVE-2022-27593 exists in QNAP Photo Station, a photo management application that runs on QNAP NAS devices. The vulnerability is an externally controlled reference to a resource (CWE-610), which allows a remote attacker to manipulate references used by the application to access system files. When Photo Station processes certain requests, it uses externally supplied data to construct file paths or resource references without adequate validation, allowing the attacker to reference and modify files outside the intended Photo Station directory. This system file modification capability was exploited by the DeadBolt ransomware to gain persistent access and encrypt all data on affected NAS devices. The attack is particularly effective because QNAP NAS devices are often directly connected to the internet for remote file access.
Frequently Asked Questions
Is CVE-2022-27593 being actively exploited?
Yes, CVE-2022-27593 is actively exploited and was the primary attack vector for the DeadBolt ransomware campaign targeting QNAP NAS devices globally. The EPSS score of 92.96% confirms widespread exploitation.
What products are affected by CVE-2022-27593?
CVE-2022-27593 affects QNAP NAS devices running Photo Station that are exposed to the internet. All Photo Station versions prior to the patched release are vulnerable.
How do I fix CVE-2022-27593?
Update Photo Station to the latest version or switch to QuMagie. Most importantly, remove the NAS from direct internet exposure and use VPN for remote access.
How severe is CVE-2022-27593?
CVE-2022-27593 is a critical vulnerability with an EPSS score of 92.96% (99.78th percentile) and confirmed ransomware usage. The DeadBolt ransomware campaign exploited this vulnerability to encrypt data on thousands of QNAP NAS devices.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.