{"id":"CVE-2022-27593","published":"2022-09-08T11:15:19Z","modified":"2026-06-17T04:37:19Z","title":"QNAP Photo Station Externally Controlled Reference Vulnerability","vendor":"QNAP","product":"Photo Station","tier":"core","eol":null,"description":{"text":"An externally controlled reference to a resource vulnerability has been reported to affect QNAP NAS running Photo Station. If exploited, This could allow an attacker to modify system files. We have already fixed the vulnerability in the following versions: QTS 5.0.1: Photo Station 6.1.2 and later QTS 5.0.0/4.5.x: Photo Station 6.0.22 and later QTS 4.3.6: Photo Station 5.7.18 and later QTS 4.3.3: Photo Station 5.4.15 and later QTS 4.2.6: Photo Station 5.2.14 and later","provenance":"source","from":"NVD"},"summary":{"text":"An externally controlled reference to a resource flaw in QNAP Photo Station, the photo management application running on QNAP NAS devices, can be exploited to modify system files. The attack vector indicates it is reachable over the network with low complexity and requires no privileges or user interaction.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T07:02:44Z"},"cvss":{"score":9.1,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.87908,"percentile":0.99762,"date":"2026-10-31","provenance":"source"},"kev":{"dateAdded":"2022-09-08","dueDate":"2022-09-29","ransomware":true,"requiredAction":"Apply updates per vendor instructions.","notes":"https://www.qnap.com/en/security-advisory/qsa-22-24;  https://nvd.nist.gov/vuln/detail/CVE-2022-27593","provenance":"source"},"vulncheckKev":{"dateAdded":"2022-05-18","exploitedFirstSeen":"2022-05-18","ransomware":true,"evidence":[{"url":"https://cybersecurityworks.com/howdymanage/uploads/file/Spotlight%20Report%20-%20Index%20Update%20Q2%20-%20Q3%20-%20Final%20Version_compressed.pdf","date":"2022-05-18"},{"url":"https://www.qnap.com/en-us/security-advisory/qsa-22-24","date":"2022-09-03"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2022-09-08"},{"url":"https://www.ivanti.com/resources/v/doc/pr-survey-report/ransomware-quarterly-indexreport_q2-q3","date":"2022-10-21"},{"url":"https://cisa.gov/news-events/cybersecurity-advisories/aa23-215a","date":"2023-08-03"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2023-11-13&host_type=src&vulnerability=cve-2022-27593","date":"2023-11-13"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2023-11-15&host_type=src&vulnerability=cve-2022-27593","date":"2023-11-15"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2023-11-16&host_type=src&vulnerability=cve-2022-27593","date":"2023-11-16"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2023-11-17&host_type=src&vulnerability=cve-2022-27593","date":"2023-11-17"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2023-11-19&host_type=src&vulnerability=cve-2022-27593","date":"2023-11-19"}],"evidenceTotal":508,"provenance":"source"},"exploited":true,"otx":null,"cwes":[{"id":"CWE-610","name":"Externally Controlled Reference to a Resource in Another Sphere"}],"references":[{"url":"https://www.qnap.com/en/security-advisory/qsa-22-24","tags":["Vendor Advisory"]},{"url":"https://www.qnap.com/en/security-advisory/qsa-22-24","tags":["Vendor Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-27593","tags":["US Government Resource"]}],"techniques":[{"id":"T1190","name":"Exploit Public-Facing Application","tactics":["initial-access"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Network-exploitable flaw in exposed Photo Station service","mappingType":"exploitation_technique","evidence":[{"from":"description","quote":"could allow an attacker to modify system files","start":142,"end":188}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"},{"id":"T1565.001","name":"Stored Data Manipulation","tactics":["impact"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Attacker modifies stored system files directly","mappingType":"primary_impact","evidence":[{"from":"description","quote":"could allow an attacker to modify system files","start":142,"end":188}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"}],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2022-32094","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-32094","exploited":true,"exploitedSince":"2022-09-08","provenance":"source"},"exploits":[],"exploitSources":{"nuclei":[{"id":"CVE-2022-27593","name":"QNAP QTS Photo Station External Reference - Local File Inclusion","severity":"critical","path":"http/cves/2022/CVE-2022-27593.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-27593.yaml"}],"provenance":"source"},"exploitRefs":[],"flow":[{"stage":"exploitation","techniques":["T1190"],"provenance":"ai"},{"stage":"primary","techniques":["T1565.001"],"provenance":"ai"}],"timeline":[{"date":"2022-05-18","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://cybersecurityworks.com/howdymanage/uploads/file/Spotlight%20Report%20-%20Index%20Update%20Q2%20-%20Q3%20-%20Final%20Version_compressed.pdf","provenance":"source"},{"date":"2022-09-08","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-27593","provenance":"source"},{"date":"2022-09-08","kind":"kev","label":"Added to CISA KEV (known ransomware use)","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2022-09-08","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-32094","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":0},"priority":{"score":76.3,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 1628 days ago"},{"name":"Known ransomware use","points":10.0,"detail":"CISA KEV and VulnCheck KEV: Known"},{"name":"EPSS percentile","points":19.95,"detail":"percentile 0.9976"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 nuclei template"},{"name":"Mentioned in OTX pulses","points":0.0,"detail":"0 pulses"},{"name":"CVSS severity","points":6.37,"detail":"base score 9.1"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}