Reference page — cumulative record through Sunday, October 4, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.

CVE-2022-27593

CVE-2022-27593CRITICAL

QNAP Systems Inc. Photo Station — DeadBolt Ransomware

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  C  L  H  H   10.0   .8791   99.8   YES

AFFECTED
  Product        Versions       Fixed
  Photo Station  unspecified –  —
  Photo Station  unspecified –  —
  Photo Station  unspecified –  —
  Photo Station  unspecified –  —
  Photo Station  unspecified –  —
  Photo Station  unspecified –  —

TIMELINE
  Mar 21  Reserved by qnap
  Sep 8   Added to CISA KEV, remediation due 2022-09-29
  Sep 8   Published (CNA: qnap)

CWE-610 · CNA: qnap · CVSS v3.1 · 2 references · KEV due September 29, 2022

Description

An externally controlled reference to a resource vulnerability has been reported to affect QNAP NAS running Photo Station. If exploited, This could allow an attacker to modify system files. We have already fixed the vulnerability in the following versions: QTS 5.0.1: Photo Station 6.1.2 and later QTS 5.0.0/4.5.x: Photo Station 6.0.22 and later QTS 4.3.6: Photo Station 5.7.18 and later QTS 4.3.3: Photo Station 5.4.15 and later QTS 4.2.6: Photo Station 5.2.14 and later

Lifecycle

Complete event history — 3 events, chronological
Date	Event	Detail
March 21, 2022	Reserved	Reserved by qnap
September 8, 2022	KEV ADDED	Added to CISA KEV, remediation due 2022-09-29
September 8, 2022	Published	Published (CNA: qnap)

Affected

Affected products and packages — 6 rows
Vendor	Product / Package	Ecosystem	Version introduced	Fixed
QNAP Systems Inc.	Photo Station	—	unspecified	—
QNAP Systems Inc.	Photo Station	—	unspecified	—
QNAP Systems Inc.	Photo Station	—	unspecified	—
QNAP Systems Inc.	Photo Station	—	unspecified	—
QNAP Systems Inc.	Photo Station	—	unspecified	—
QNAP Systems Inc.	Photo Station	—	unspecified	—

Weaknesses

CWE-610

References (2)

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-27593 [government-resource]
https://www.qnap.com/en/security-advisory/qsa-22-24 [x_refsource_MISC]

Authoritative record: CVE-2022-27593 at cve.org

Vendors: qnap systems

Weaknesses: CWE-610

About this page

This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2022-27593 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Sunday, October 4, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.