Critical severity · published Dec 5, 2019
CVE-2019-7192
QNAP Photo Station Improper Access Control Vulnerability
RansomwareIn wildKEV
9.8
CVSS
88.1%
EPSS
Yes
On KEV
Description
This improper access control vulnerability allows remote attackers to gain unauthorized access to the system. To fix these vulnerabilities, QNAP recommend updating Photo Station to their latest versions.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)88.1% · higher than 100% of CVEs
Exploited in the wildYes
CISA KEVListed Jun 8, 2022
Federal remediation dueJun 22, 2022
Ransomware campaign useKnown
Affected products
Which versions
QN
QNAP NAS devices running Photo Station ·
QTS 4.4.1: Photo Station before version 6.0.3, QTS 4.3.4 - QTS 4.4.0: Photo Station before version 5.7.10, QTS 4.3.0 - QTS 4.3.3: Photo Station before version 5.4.9, QTS 4.2.6: Photo Station before version 5.2.11 · source: vendor
PS
Photo Station · Qnap
before 6.0.3; before 5.7.10; before 5.4.9; before 5.2.11 · source: NVD, KEV
Affected product
QN
QNAP NAS devices running Photo Station
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-7192
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-7192
CISA KEV catalogue
https://www.cisa.gov/known-exploited-vulnerabilities-catalog
x_refsource_CONFIRM
https://www.qnap.com/zh-tw/security-advisory/nas-201911-25
x_refsource_MISC
http://packetstormsecurity.com/files/157857/QNAP-QTS-And-Photo-Station-6.0.3-Remote-Command-Execution.html
More from QNAP NAS devices running Photo Station
9.8
CVE-2019-7195
QNAP Photo Station Path Traversal Vulnerability
9.8
CVE-2019-7194
QNAP Photo Station Path Traversal Vulnerability