CVE-2021-44057 Improper authentication in Photo Station

What is CVE-2021-44057?

CVE-2021-44057 is a high-severity authentication bypass vulnerability in QNAP Systems Inc. Photo Station, published on 5 May 2022. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

An improper authentication vulnerability has been reported to affect QNAP device running Photo Station. If exploited, this vulnerability allows attackers to compromise the security of the system. We have already fixed this vulnerability in the following versions of Photo Station: Photo Station 6.0.20 ( 2022/02/15 ) and later Photo Station 5.7.16 ( 2022/02/11 ) and later Photo Station 5.4.13 ( 2022/02/11 ) and later

Weakness: CWE-287

Which versions are affected by CVE-2021-44057?

It affects 1 product.

Products include Qnap Photo Station.

How do I fix CVE-2021-44057?

No fix has been published for CVE-2021-44057 yet. Limit exposure of the affected software until one is available.

Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.

Is CVE-2021-44057 being exploited?

There is no known exploitation of CVE-2021-44057 in the wild and no public exploit code.

Other vulnerabilities in QNAP Systems Inc. Photo Station

• CVE-2022-27593 QNAP Photo Station Externally Controlled Reference Exploited Critical 10.0
• CVE-2019-7192 QNAP Photo Station Improper Access Control Exploited Critical 9.8
• CVE-2019-7194 QNAP Photo Station Path Traversal Exploited Critical 9.8
• CVE-2019-7195 QNAP Photo Station Path Traversal Exploited Critical 9.8
• CVE-2017-20210 Photo Station Critical 9.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-9mp7-fmr4-g9vw.