CVE-2019-7192
Published 2019-12-05 · Updated 2026-06-17 · Source security@qnapsecurity.com.tw
Summary
CVE-2019-7192 is a critical-severity (CVSS 9.8) vulnerability in QNAP Photo Station. CISA added it to the Known Exploited Vulnerabilities catalog on June 8, 2022, which means exploitation in the wild has been confirmed; US federal agencies had to remediate it by June 22, 2022. CISA also lists it as known to be used in ransomware campaigns, so it should be prioritised accordingly. QNAP has 11 vulnerabilities in the KEV catalog, 9 of them linked to ransomware.
All 11 known-exploited QNAP vulnerabilities →Description
This improper access control vulnerability allows remote attackers to gain unauthorized access to the system. To fix these vulnerabilities, QNAP recommend updating Photo Station to their latest versions.
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA Known-Exploited Vulnerability
Product: QNAP — Photo Station
Name: QNAP Photo Station Improper Access Control Vulnerability
Date added: 2022-06-08 · Due: 2022-06-22
Required action: Apply updates per vendor instructions.
References
- http://packetstormsecurity.com/files/157857/QNAP-QTS-And-Photo-Station-6.0.3-Remote-Command-Execution.html
- https://www.qnap.com/zh-tw/security-advisory/nas-201911-25
- http://packetstormsecurity.com/files/157857/QNAP-QTS-And-Photo-Station-6.0.3-Remote-Command-Execution.html
- https://www.qnap.com/zh-tw/security-advisory/nas-201911-25
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-7192