QNAP · Photo Station

CVE-2022-27593

DeadBolt Ransomware

Exploited in attacks Used by ransomware Critical 10.0 Attack chance: 88%

What it is

An externally controlled reference to a resource vulnerability has been reported to affect QNAP NAS running Photo Station. If exploited, This could allow an attacker to modify system files. We have already fixed the vulnerability in the following versions: QTS 5.0.1: Photo Station 6.1.2 and later QTS 5.0.0/4.5.x: Photo Station 6.0.22 and later QTS 4.3.6: Photo Station 5.7.18 and later QTS 4.3.3: Photo Station 5.4.15 and later QTS 4.2.6: Photo Station 5.2.14 and later

CISA: Certain QNAP NAS running Photo Station with internet exposure contain an externally controlled reference to a resource vulnerability which can allow an attacker to modify system files. This vulnerability was observed being utilized in a Deadbolt ransomware campaign.

What to do

Apply updates per vendor instructions.

Deadline for US federal agencies: September 29, 2022

Added to the CISA list: September 8, 2022
Published: September 8, 2022
Severity: Critical 10.0 CVSS 3.1
Chance of attacks in the next 30 days (EPSS): 88% in the top 0.2% of all known vulnerabilities
Weakness: CWE-610
More details: NVD · CVE.org · CISA

All references (1)

https://www.qnap.com/en/security-advisory/qsa-22-24

More exploited flaws from QNAP

Added	Vulnerability	Product	Severity	Attack chance
Jun 8, 2022	Improper Access ControlCVE-2019-7192used by ransomware	Photo Station	Critical 9.8	88%
Jun 8, 2022	Path TraversalCVE-2019-7194used by ransomware	Photo Station	Critical 9.8	83%
Jun 8, 2022	Path TraversalCVE-2019-7195used by ransomware	Photo Station	Critical 9.8	90%
Dec 21, 2023	OS Command InjectionCVE-2023-47565	VioStor NVR	High 8.0	73%
Jun 8, 2022	Improper Input ValidationCVE-2019-7193used by ransomware	QTS	Critical 9.8	14%
May 24, 2022	NAS File Station Cross-Site ScriptingCVE-2018-19943used by ransomware	Network Attached Storage (NAS)	High 8.0	23%
May 24, 2022	NAS File Station Command InjectionCVE-2018-19949used by ransomware	Network Attached Storage (NAS)	Critical 9.8	30%
May 24, 2022	NAS File Station Cross-Site ScriptingCVE-2018-19953used by ransomware	Network Attached Storage (NAS)	Medium 6.1	31%

All of them →

Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.