Critical severity · published Dec 5, 2019
CVE-2019-7195
QNAP Photo Station Path Traversal Vulnerability
RansomwareIn wildKEV
9.8
CVSS
89.7%
EPSS
Yes
On KEV
Description
This external control of file name or path vulnerability allows remote attackers to access or modify system files. To fix the vulnerability, QNAP recommend updating Photo Station to their latest versions.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)89.7% · higher than 100% of CVEs
Exploited in the wildYes
CISA KEVListed Jun 8, 2022
Federal remediation dueJun 22, 2022
Ransomware campaign useKnown
Affected products
Which versions
QN
QNAP NAS devices running Photo Station ·
QTS 4.4.1: Photo Station before version 6.0.3, QTS 4.3.4 - QTS 4.4.0: Photo Station before version 5.7.10, QTS 4.3.0 - QTS 4.3.3: Photo Station before version 5.4.9, QTS 4.2.6: Photo Station before version 5.2.11 · source: vendor
PS
Photo Station · Qnap
before 6.0.3; before 5.7.10; before 5.4.9; before 5.2.11 · source: NVD, KEV
Affected product
QN
QNAP NAS devices running Photo Station
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-7195
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-7195
CISA KEV catalogue
https://www.cisa.gov/known-exploited-vulnerabilities-catalog
x_refsource_CONFIRM
https://www.qnap.com/zh-tw/security-advisory/nas-201911-25
x_refsource_MISC
http://packetstormsecurity.com/files/157857/QNAP-QTS-And-Photo-Station-6.0.3-Remote-Command-Execution.html
More from QNAP NAS devices running Photo Station
9.8
CVE-2019-7194
QNAP Photo Station Path Traversal Vulnerability
9.8
CVE-2019-7192
QNAP Photo Station Improper Access Control Vulnerability