CVE-2022-27593DeadBolt Ransomware
Bekannt ausgenutzt — QNAP Photo Station Externally Controlled Reference Vulnerability
CISA hat am 08.09.2022 bestätigt, dass diese Schwachstelle in echten Angriffen genutzt wird. Frist für US-Bundesbehörden: 29.09.2022.
Erforderliche Maßnahme: Apply updates per vendor instructions. https://www.qnap.com/en/security-advisory/qsa-22-24; https://nvd.nist.gov/vuln/detail/CVE-2022-27593
Beschreibung
An externally controlled reference to a resource vulnerability has been reported to affect QNAP NAS running Photo Station. If exploited, This could allow an attacker to modify system files. We have already fixed the vulnerability in the following versions: QTS 5.0.1: Photo Station 6.1.2 and later QTS 5.0.0/4.5.x: Photo Station 6.0.22 and later QTS 4.3.6: Photo Station 5.7.18 and later QTS 4.3.3: Photo Station 5.4.15 and later QTS 4.2.6: Photo Station 5.2.14 and later
Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.
Betroffene Produkte und Versionen
| Hersteller | Produkt | Versionen | |
|---|---|---|---|
| QNAP Systems Inc. | Photo Station | unspecified – < 6.1.2 |
Referenzen und Patches
- https://www.qnap.com/en/security-advisory/qsa-22-24 Vendor Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-27593 US Government Resource
CPE-Treffer (NVD) (5)
cpe:2.3:a:qnap:photo_station:*:*:*:*:*:*:*:*< 5.2.14cpe:2.3:a:qnap:photo_station:*:*:*:*:*:*:*:*< 5.4.15cpe:2.3:a:qnap:photo_station:*:*:*:*:*:*:*:*< 5.7.18cpe:2.3:a:qnap:photo_station:*:*:*:*:*:*:*:*< 6.0.22cpe:2.3:a:qnap:photo_station:*:*:*:*:*:*:*:*< 6.1.2