CVE-2022-27593
Qnap Photo Station ≤ 5.2.14
Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:HSummary
CVE-2022-27593 is a critical-severity Externally Controlled Reference to a Resource in Another Sphere (CWE-610) vulnerability in Qnap Qts. Its CVSS base score is 10.0 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Data from Local System (T1005); ranked in the top 0.3% of CVEs by exploit likelihood; CISA has added it to the Known Exploited Vulnerabilities catalog.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2022-27593 is an externally controlled reference to a resource vulnerability, tracked under CWE-610, that affects QNAP NAS devices running Photo Station. The flaw permits unauthorized modification of system files and carries a CVSS 3.1 base score of 10.0. QNAP has released fixes in Photo Station 6.1.2 and later for QTS 5.0.1, 6.0.22 and later for QTS 5.0.0/4.5.x, 5.7.18 and later for QTS 4.3.6, 5.4.15 and later for QTS 4.3.3, and 5.2.14 and later for QTS 4.2.6.
An unauthenticated attacker with network access can exploit the issue without user interaction to alter system files on the affected NAS. Successful exploitation can lead to integrity and availability impacts as well as limited confidentiality exposure under the CVSS scope change.
QNAP security advisory QSA-22-24 details the fixed Photo Station versions and urges immediate installation. The vulnerability also appears in the CISA Known Exploited Vulnerabilities catalog, confirming observed in-the-wild exploitation.
The associated EPSS score has reached 0.9378, indicating a high likelihood of exploitation attempts.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-32094
Vulnerability Data
An externally controlled reference to a resource vulnerability has been reported to affect QNAP NAS running Photo Station. If exploited, This could allow an attacker to modify system files. We have already fixed the vulnerability in the following versions: QTS…
more
5.0.1: Photo Station 6.1.2 and later QTS 5.0.0/4.5.x: Photo Station 6.0.22 and later QTS 4.3.6: Photo Station 5.7.18 and later QTS 4.3.3: Photo Station 5.4.15 and later QTS 4.2.6: Photo Station 5.2.14 and later
- CWE(s)
- KEV Date Added
- 08 September 2022
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
- 3 hardening rules · 2 OS baselines
—
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Limits impact of an externally controlled reference to a primary information resource by switching to an identified alternative.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure development practices directly require input validation and reference sanitization that prevent externally-controlled resource references.
Runtime monitoring of software and data flows can detect anomalous external resource accesses that result from this weakness.
Network segmentation and access controls limit the blast radius when an external reference escapes its intended sphere.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing can detect instances of the weakness but does not prevent it at design or coding time.
Secure development lifecycle mandates validation of all external references to prevent uncontrolled resource access.
Application security requirements explicitly call for controls against externally supplied resource identifiers.
Secure architecture principles reduce the attack surface for externally controlled references but do not prescribe specific validation rules.
Secure coding standards require input validation and canonicalization to block externally controlled resource references.
Information access restriction limits what resources can be reached, indirectly reducing impact of external references.
Hardening callouts derived
Configuration rules from DISA STIG baselines that bear on weaknesses of the type cited by this CVE. Each rule is shown with the relationship its mapping actually records, against the CWE it was authored against. Derived via CVE→CWE over `controls_xwalks` (authoritative rows only; rows rated `none` are excluded).
Oracle Linux 8 (1 rule)
- V-248577 OL 8 must enable kernel parameters to enforce Discretionary Access Control (DAC) on symlinks. prevents CWE-610