QNAP Photo Station Externally-Controlled Reference Vulnerability (CVE-2022-27593) Technical Advisory
Executive & SecOps Summary
SECOPS ASSESSMENTQNAP Photo Station running on QTS 5.0.1, 5.0.0, 4.5.x, 4.3.6, 4.3.3, and 4.2.6
Unauthenticated remote attackers can modify critical system files, potentially leading to complete device compromise
Immediately update Photo Station to the patched versions (6.1.2, 6.0.22, 5.7.18, 5.4.15, 5.2.14 or later)
Affected Products & Version Scope
Remediation & Live Workaround Commands
PATCH & WORKAROUND1. Official Patch & Version Upgrade Commands
Update Photo Station to the latest secure version via the QNAP App Center. You can also perform the update via the SSH command-line interface.
# Update all packages including Photo Station via QNAP CLI
/sbin/qpkg_cli --update_all
/sbin/qpkg_cli --info PhotoStation2. Temporary Workaround & Hardening Configuration
If immediate patching is not feasible, disable the Photo Station application and restrict external access to the NAS management interface.
# Disable the Photo Station application immediately
/sbin/qpkg_cli --disable PhotoStation
# Block external access and restrict traffic to trusted internal subnets only
# (It is highly recommended to configure this via QuFirewall in the QTS GUI)3. Log Audit & IoC Verification Commands
Verify the currently installed version of Photo Station and inspect web server logs for potential exploitation attempts.
# Check the currently installed Photo Station version
getcfg PhotoStation Version -f /etc/config/qpkg.conf
# Scan Apache access logs for suspicious path traversal or resource manipulation attempts
fgrep -i 'PhotoStation' /usr/local/apache/logs/access_log | grep -E '(\.\./|etc|config)'Block Kernel Privilege Escalation & Ransomware Payloads Before You Can Reboot
Protect unpatched Windows, Linux, and macOS workloads against in-memory exploitation and lateral movement with autonomous EDR.
Technical Root Cause & Exploitation Mechanics
1. Vulnerability Overview & Root Cause
This vulnerability (CVE-2022-27593) is an externally-controlled reference to a resource vulnerability (CWE-610) affecting QNAP NAS devices running Photo Station. The root cause lies in the application's failure to properly sanitize and validate user-supplied input before using it to reference system resources or file paths. This allows an attacker to manipulate input parameters to point to arbitrary files on the system.
2. Exploitation Mechanics & Attack Scenario
An unauthenticated remote attacker can exploit this vulnerability by sending crafted HTTP requests to the Photo Station web application. By manipulating specific parameters that control file paths or resource references, the attacker bypasses directory traversal protections or input validation routines. This enables the modification of critical system configuration files or application binaries, leading to unauthorized system state changes.
3. Infrastructure & Business Impact
Given that this vulnerability is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, active exploitation has been observed in the wild. Successful exploitation allows attackers to modify system files, which can be leveraged to plant backdoors, bypass authentication, or execute arbitrary code. This poses a severe risk of data exfiltration, ransomware deployment, and lateral movement within the enterprise network.
Official Vendor Advisories & References
An externally controlled reference to a resource vulnerability has been reported to affect QNAP NAS running Photo Station. If exploited, This could allow an attacker to modify system files. We have already fixed the vulnerability in the following versions: QTS 5.0.1: Photo Station 6.1.2 and later QTS 5.0.0/4.5.x: Photo Station 6.0.22 and later QTS 4.3.6: Photo Station 5.7.18 and later QTS 4.3.3: Photo Station 5.4.15 and later QTS 4.2.6: Photo Station 5.2.14 and later
Frequently Asked SecOps Questions (CVE-2022-27593)
FAQQ1. How critical is CVE-2022-27593 and is it actively exploited in the wild?
CVE-2022-27593 is rated CVSS 9.1 (CRITICAL) with a 30-day EPSS exploitation probability of 87.9%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.
Q2. Which vendors and products are affected by CVE-2022-27593?
Primary impacted vendors include qnap across photo station, qts. Scope summary: Affected QNAP Photo Station versions based on QTS releases: - QTS 5.0.1: Photo Station prior to 6.1.2 - QTS 5.0.0 / 4.5.x: Photo Station prior to 6.0.22 - QTS 4.3.6: Photo Station prior to 5.7.18 - QTS 4.3.3: Photo Station prior to 5.4.15 - QTS 4.2.6: Photo Station prior to 5.2.14
Q3. What temporary mitigations or workarounds exist for CVE-2022-27593 before patching?
[Mitigation] Immediately update Photo Station to the patched versions (6.1.2, 6.0.22, 5.7.18, 5.4.15, 5.2.14 or later) Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.
Generate an Internal Engineering Notice or CISO Report for CVE-2022-27593
Instantly format this advisory into an executive CISO summary or engineering patch ticket.
🔗 Related Advisories in Similar Stack (qnap)
View Category →Apple macOS Screen Sharing Authentication Bypass Vulnerability (CVE-2026-65400)
[Affected Scope] macOS systems running versions prior to Sequoia 15.7.9, Sonoma 14.8.9, Tahoe 26.6.1/26.7, or Golden Gate 27 with Screen Sharing or VNC services enabled
DAEMON Tools Lite Official Installer Supply Chain Attack and Trojanized Binaries (CVE-2026-8398)
[Affected Scope] DAEMON Tools Lite Windows versions 12.5.0.2421 through 12.5.0.2434 distributed between April 8, 2026, and May 5, 2026
Microsoft Windows Shell Command Injection and Security Feature Bypass (CVE-2026-96951) Advisory
[Affected Scope] All supported versions of Windows OS including Windows 10, 11, and Windows Server.
Apple iOS and macOS Out-of-bounds Write Remote Code Execution Vulnerability (CVE-2026-86950) Security Advisory
[Affected Scope] All Apple devices running versions prior to iOS 18.7.11/26.7.1 and macOS Sequoia 15.8.1/Tahoe 26.7.1.
Subscribe to Daily Vulnerability Briefings & KEV Alerts
Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.