CVE-2022-27593

CVE-2022-27593: QNAP Photo Station Externally Controlled Reference to Resource (CWE-610)

AI-generated analysis based on the vulnerability data on this page.

Summary

CVE-2022-27593 is a critical vulnerability in QNAP's Photo Station application for QNAP NAS devices. The flaw stems from an externally controlled reference to a resource (CWE-610), enabling an unauthenticated remote attacker to manipulate system files on the affected NAS. With a CVSS v3.1 score of 10.0 and confirmed active exploitation, this vulnerability demands immediate attention from all QNAP Photo Station administrators.

Background

QNAP Photo Station is a media management and sharing application bundled with QNAP's QTS operating system for Network Attached Storage (NAS) devices. NAS devices are frequently deployed at network edge positions, directly exposed to the internet for remote access, file sharing, and media streaming. This exposure makes NAS appliances high-value targets for threat actors seeking to gain footholds in home, small-business, and enterprise networks.

Root Cause

The vulnerability is classified as CWE-610: Externally Controlled Reference to a Resource in Another Sphere. In this context, Photo Station improperly handles externally supplied input that references files or resources on the underlying QTS system. An attacker can supply a crafted request referencing sensitive system paths, and the application fails to adequately validate or sanitize these references before processing them. This path traversal or file-inclusion style weakness allows the attacker to reach outside the intended application directory and interact with critical operating system files.

The CVSS v3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:H underscores the severity:

• Attack Vector (AV):N — Exploitable over the network with no local access required.
• Attack Complexity (AC):L — No special conditions or complex steps needed.
• Privileges Required (PR):N — No authentication necessary.
• User Interaction (UI):N — No victim interaction required.
• Scope (S):C — The vulnerable component impacts resources beyond its own security scope (the underlying QTS OS).
• Confidentiality (C):L, Integrity (I):H, Availability (A):H — System files can be modified, leading to high integrity and availability impact.

Impact

Successful exploitation of this vulnerability allows an unauthenticated remote attacker to:

• Modify system files on the QNAP NAS, including configuration files, binaries, or startup scripts.
• Potentially achieve full device compromise by replacing critical OS components or planting persistent backdoors.
• Disrupt NAS operations by corrupting system data or deleting files (high availability impact).
• Use the compromised NAS as a pivot point into the broader internal network.

The scope change (S:C) is particularly important: Photo Station runs as an application-layer service, yet the flaw allows the attacker to affect the integrity and availability of the entire QTS operating system underneath it.

Exploitation Walkthrough

Ethics caveat: The following describes the exploitation mechanism at a defensive level to aid detection and mitigation. No weaponized exploit code is provided. Organizations should use this information to understand attack patterns, not to reproduce attacks against systems they do not own.

An attacker targets an internet-facing QNAP NAS running a vulnerable version of Photo Station. By crafting an HTTP request that includes a malicious file reference or path parameter, the attacker causes Photo Station to resolve that reference against the underlying QTS filesystem. Because the input is not properly validated, the reference resolves to a system file location rather than the intended application directory. The attacker can then overwrite, append to, or delete that system file. Since no authentication is required and the attack is trivial to execute (AC:L), opportunistic mass-exploitation is highly feasible — consistent with the observed EPSS and KEV data.

Affected and Patched Versions

All earlier versions of Photo Station on the listed QTS branches are vulnerable.

Remediation

1. Upgrade immediately. Apply the patched Photo Station version corresponding to your QTS release from the table above. QNAP has published the fixes in QSA-22-24.
2. Disable Photo Station if it is not required, until patching is complete.
3. Compensating controls:
   • Restrict inbound access to the NAS management interface and Photo Station to trusted IP ranges only (do not expose directly to the internet).
   • Enable QNAP's Security Counselor and ensure automatic security updates are configured.
   • Segment NAS devices on a dedicated network VLAN with strict egress filtering.
   • Review and enforce strong firewall rules at the network perimeter.

Detection

• Network: Monitor for anomalous HTTP requests to Photo Station endpoints containing path-like sequences (../, absolute paths, or unexpected file extensions).
• Host: Monitor the NAS filesystem for unauthorized changes to system directories (/etc, /usr, /share, QTS internal paths) outside of scheduled maintenance windows.
• Logs: Review QTS system logs and Photo Station access logs for requests from unexpected source IPs, especially shortly before file-modification events.
• Threat Intelligence: Cross-reference inbound traffic against known exploitation indicators. Given the KEV and EU-exploited status, threat-intel feeds likely contain IOCs for this vulnerability.

Assessment

CVE-2022-27593 is a textbook example of a critical-severity, trivially exploitable NAS vulnerability that is actively exploited in the wild. The EPSS score of 0.87908 places it in the top 0.3% of all CVEs by exploitation probability, and its presence on both the CISA KEV catalog and the EU exploited vulnerabilities list confirms real-world weaponization.

Key lessons:

1. Input validation is non-negotiable. Any application that accepts file or resource references from untrusted input must rigorously validate and sanitize them against directory traversal and unexpected scope changes.
2. NAS exposure to the internet is high-risk. Devices running web-facing applications like Photo Station should never be directly accessible from untrusted networks without additional protective controls.

References

• https://www.qnap.com/en/security-advisory/qsa-22-24
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-27593