title: DeadBolt Ransomware
description: An externally controlled reference to a resource vulnerability has been reported to affect QNAP NAS running Photo Station. If exploited, This could allow an attacker to modify system files. We have already fixed the vulnerability in the following versions: QTS 5.0.1: Photo Station 6.1.2 and later QTS 5.0.0/4.5.x: Photo Station 6.0.22 and later QTS 4.3.6: Photo Station 5.7.18 and later QTS 4.3.3: Photo Station 5.4.15 and later QTS 4.2.6: Photo Station 5.2.14 and later
problem types: CWE-610 Externally Controlled Reference to a Resource in Another Sphere
affected:
{
platforms: QTS 5.0.1
product: Photo Station
vendor: QNAP Systems Inc.
versions:
lessThan: 6.1.2, status: affected, version: unspecified, versionType: custom
}
{
platforms: QTS 5.0.0
product: Photo Station
vendor: QNAP Systems Inc.
versions:
lessThan: 6.0.22, status: affected, version: unspecified, versionType: custom
}
{
platforms: QTS 4.5.x
product: Photo Station
vendor: QNAP Systems Inc.
versions:
lessThan: 6.0.22, status: affected, version: unspecified, versionType: custom
}
{
platforms: QTS 4.3.6
product: Photo Station
vendor: QNAP Systems Inc.
versions:
lessThan: 5.7.18, status: affected, version: unspecified, versionType: custom
}
{
platforms: QTS 4.3.3
product: Photo Station
vendor: QNAP Systems Inc.
versions:
lessThan: 5.4.15, status: affected, version: unspecified, versionType: custom
}
{
platforms: QTS 4.2.6
product: Photo Station
vendor: QNAP Systems Inc.
versions:
lessThan: 5.2.14, status: affected, version: unspecified, versionType: custom
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 10
baseSeverity: CRITICAL
confidentialityImpact: LOW
integrityImpact: HIGH
privilegesRequired: NONE
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:H
version: 3.1
]
solutions: QNAP have already fixed the vulnerability in the following versions:
QTS 5.0.1: Photo Station 6.1.2 and later
QTS 5.0.0/4.5.x: Photo Station 6.0.22 and later
QTS 4.3.6: Photo Station 5.7.18 and later
QTS 4.3.3: Photo Station 5.4.15 and later
QTS 4.2.6: Photo Station 5.2.14 and later