Critical severity · published Dec 5, 2019
CVE-2019-7193
QNAP QTS Improper Input Validation Vulnerability
RansomwareIn wildKEV
9.8
CVSS
14.4%
EPSS
Yes
On KEV
Description
This improper input validation vulnerability allows remote attackers to inject arbitrary code to the system. To fix the vulnerability, QNAP recommend updating QTS to their latest versions.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)14.4% · higher than 97% of CVEs
Exploited in the wildYes
CISA KEVListed Jun 8, 2022
Federal remediation dueJun 22, 2022
Ransomware campaign useKnown
Affected products
Which versions
QN
QNAP NAS devices ·
QTS 4.4.0 - QTS 4.4.1: before build 20190918, QTS 4.3.6: before build 20190919 · source: vendor
QT
Qts · Qnap
4.3.6.0895; 4.3.6.0907; 4.3.6.0923; 4.3.6.0944; 4.3.6.0959; 4.3.6.0979; +10 more · source: NVD, KEV
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-7193
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-7193
CISA KEV catalogue
https://www.cisa.gov/known-exploited-vulnerabilities-catalog
x_refsource_CONFIRM
https://www.qnap.com/zh-tw/security-advisory/nas-201911-25
x_refsource_MISC
http://packetstormsecurity.com/files/157857/QNAP-QTS-And-Photo-Station-6.0.3-Remote-Command-Execution.html