CVE-2022-27593

What it actually does

CVE-2022-27593 is a network-exploitable improper input validation / externally controlled reference vulnerability in QNAP Photo Station on QTS. An unauthenticated remote attacker can supply crafted input that causes Photo Station to reference or write unintended system resources, allowing modification of system files. The CVSS vector indicates low-complexity remote exploitation with no privileges or user interaction required, and high integrity and availability impact, but no direct confidentiality impact. In practice, unauthorized system-file modification on a NAS can enable service disruption, persistence, configuration tampering, or staging for follow-on malware such as ransomware.

Why it matters to the business

Successful exploitation can let an outside attacker tamper with a QNAP NAS device, disrupt file-sharing and backup operations, damage or encrypt stored data, and undermine recovery processes. Because this vulnerability is in CISA KEV, has been exploited in the wild, is associated with ransomware activity, and has a high EPSS score, internet-exposed QNAP Photo Station instances should be treated as urgent remediation priorities. Organizations relying on affected NAS devices for shared storage, media management, backup staging, or small-office infrastructure may face operational downtime, data loss, ransom demands, and costly incident response if systems remain unpatched.

How an attack unfolds

An attacker first identifies an internet-accessible QNAP NAS exposing Photo Station. They then send crafted unauthenticated HTTP requests to Photo Station that abuse the externally controlled resource reference flaw. By manipulating the referenced path or resource, the attacker causes the application to modify files outside the intended scope, including sensitive system or application files. Once file modification is achieved, the attacker may alter configuration, impair services, plant web-accessible payloads where possible, or prepare the device for ransomware deployment. Public exploitation and ransomware use mean attackers are likely to automate scanning and exploitation against exposed NAS devices rather than targeting only selected victims.

How to fix it

Upgrade QNAP Photo Station to the vendor-fixed version appropriate for the installed QTS branch: for QTS 5.0.1, install Photo Station 6.1.2 or later; for QTS 5.0.0 / 4.5.x, install Photo Station 6.0.22 or later; for QTS 4.3.6, install Photo Station 5.7.18 or later; for QTS 4.3.3, install Photo Station 5.4.15 or later; for QTS 4.2.6, install Photo Station 5.2.14 or later. If immediate patching is not possible, disable Photo Station, remove internet exposure, restrict access to trusted management networks or VPN, block inbound access at the firewall, and ensure NAS admin interfaces are not publicly reachable. Review NAS backup architecture and keep offline or immutable backups because this vulnerability is associated with ransomware activity. Rotate credentials and review device integrity if exploitation is suspected before returning the device to production.

How to confirm the fix worked

Confirm the installed QTS branch and Photo Station package version from the QNAP App Center or package inventory and verify it meets or exceeds the fixed version for that branch. From an external network perspective, confirm Photo Station and QNAP management services are not exposed to the public internet unless explicitly required and protected. Run authenticated vulnerability scans or configuration audits that identify QNAP Photo Station versions. Validate that firewall, router, UPnP, and port-forwarding rules do not publish NAS web services unexpectedly. If the device was exposed before patching, perform forensic review for suspicious file changes, unknown scheduled tasks, unauthorized users, unexpected web-accessible files, and ransomware artifacts before considering remediation complete.

Typical attack path

1. Scan the internet or target network ranges for QNAP NAS devices exposing Photo Station.
2. Fingerprint QTS and Photo Station versions to identify vulnerable deployments.
3. Send crafted unauthenticated requests to Photo Station that manipulate externally controlled resource references.
4. Modify unintended system or application files on the NAS.
5. Use file modification to disrupt services, alter configuration, stage payloads, or enable persistence.
6. Deploy ransomware or destructive actions against NAS-hosted files and backups.

How to detect it

Review QNAP system, application, and web access logs for suspicious unauthenticated requests to Photo Station around and after 2022-09-08, especially from unfamiliar external IP addresses, high-volume scanning sources, requests containing path traversal patterns, encoded traversal sequences, unusual resource or file parameters, or attempts to access or modify system paths. Examine Photo Station and QTS audit logs for failed or unauthenticated access followed by file changes, service restarts, configuration changes, new users, privilege changes, or package modifications. Use file integrity checks to identify unexpected changes to system files, web application files, startup scripts, cron jobs, and QNAP application directories. Look for ransomware indicators on NAS shares, including mass file renames, new ransom notes, sudden spikes in file modifications, and encrypted file extensions. Network telemetry should be searched for inbound HTTP/HTTPS traffic to QNAP Photo Station endpoints from external scanners and outbound connections from the NAS to unknown infrastructure after suspicious requests. Because exploitation may result primarily in file modification rather than a distinctive payload, prioritize behavior-based hunting over reliance on a single IOC.

• /photo/
• Photo Station
• ../
• ..%2f
• %2e%2e%2f
• ..%252f
• %2e%2e/
• /etc/passwd
• /etc/shadow
• /etc/config/
• /share/
• /home/httpd/
• /mnt/HDA_ROOT/
• /mnt/ext/
• /etc/config/uLinux.conf
• /etc/config/passwd
• /etc/config/shadow
• DEADBOLT
• !!!_IMPORTANT_README_WHERE_ARE_MY_FILES_!!!
• README_FOR_DECRYPT.txt
• HOW_TO_DECRYPT.txt
• RECOVER_FILES.txt

What your security team should do

• Immediately identify all QNAP NAS devices running Photo Station, especially internet-exposed systems.
• Patch Photo Station to the fixed version for the relevant QTS branch or disable Photo Station if it is not required.
• Prioritize remediation as emergency work because the vulnerability is in CISA KEV, has a missed KEV due date of 2022-09-29, has active in-the-wild exploitation, high EPSS likelihood, and ransomware association.
• Remove public exposure of QNAP NAS services; require VPN or trusted-network access for administration and applications.
• Audit firewall, NAT, and UPnP configurations for unintended QNAP port forwarding.
• Hunt for signs of prior compromise, including unexpected system-file modifications, suspicious web requests to Photo Station, unknown files in web directories, new or modified admin accounts, and ransomware notes or encrypted files.
• Create or verify offline, immutable, and tested backups of NAS-hosted data before conducting disruptive remediation.
• If compromise is suspected, isolate the NAS, preserve logs and disk evidence, rebuild or reinitialize from trusted media where appropriate, and restore data from clean backups.