PT-2022-4657 · Qnap · Qnap Nas+1

Published 2022-09-03 · Updated 2024-10-17 · CVE-2022-27593

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:H

Name of the Vulnerable Software and Affected Versions QNAP NAS running Photo Station versions prior to 5.2.14 QNAP NAS running Photo Station versions prior to 5.4.15 QNAP NAS running Photo Station versions prior to 5.7.18 QNAP NAS running Photo Station versions prior to 6.0.22 QNAP NAS running Photo Station versions prior to 6.1.2

Description An externally controlled reference to a resource vulnerability has been reported to affect QNAP NAS running Photo Station. If exploited, this could allow an attacker to modify system files. The issue is related to errors in privilege management, which could allow a remote attacker to elevate their privileges in the system and execute arbitrary code.

Recommendations For QTS 5.0.1, update Photo Station to version 6.1.2 or later. For QTS 5.0.0/4.5.x, update Photo Station to version 6.0.22 or later. For QTS 4.3.6, update Photo Station to version 5.7.18 or later. For QTS 4.3.3, update Photo Station to version 5.4.15 or later. For QTS 4.2.6, update Photo Station to version 5.2.14 or later.

Fix

Improper Privilege Management

RCE

Weakness Enumeration

CWE-269

CWE-610

CWE-20

Related Identifiers

BDU:2022-05542

CVE-2022-27593

Affected Products

Photo Station

Qnap Nas

References · 9

• https://bdu.fstec.ru/vul/2022-05542 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-27593 · Security Note
• https://osv.dev/vulnerability/CVE-2022-27593 · Vendor Advisory
• https://cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-27593 · Note
• https://t.me/cvenotify/35856 · Telegram Post
• https://t.me/cibsecurity/49451 · Telegram Post
• https://qnap.com/en/security-advisory/qsa-22-24 · Vendor Advisory, Security Note
• https://twitter.com/raghav127001/status/1846843076964487483 · Twitter Post
• https://t.me/aptreports/1865 · Telegram Post