Actively exploited · Published Dec 5, 2019 · Assigned by qnap
CVE-2019-7192
Critical 9.8 Exploited Ransomware
In plain English
A critical-severity incorrect authorization in QNAP NAS devices running Photo Station. Attackers are actively exploiting it in the wild (listed by CISA on June 8, 2022). It has been used in ransomware campaigns. The chance it is exploited in the next 30 days is estimated at 88.1% (higher than 99.8% of all known vulnerabilities). Ready-made attack tooling exists: Metasploit, Nuclei, public proof-of-concept code. Apply updates per vendor instructions.
CISA guidance
Apply updates per vendor instructions.
Federal agencies must remediate by Jun 22, 2022.
Official description
This improper access control vulnerability allows remote attackers to gain unauthorized access to the system. To fix these vulnerabilities, QNAP recommend updating Photo Station to their latest versions.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| n/a | QNAP NAS devices running Photo Station | QTS 4.4.1: Photo Station before version 6.0.3, QTS 4.3.4 - QTS 4.4.0: Photo Station before version 5.7.10, QTS 4.3.0 - QTS 4.3.3: Photo Station before version 5.4.9, QTS 4.2.6: Photo Station before version 5.2.11 |
Weakness: CWE-863 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://www.qnap.com/zh-tw/security-advisory/nas-201911-25 x_refsource_CONFIRM
- http://packetstormsecurity.com/files/157857/QNAP-QTS-And-Photo-Station-6.0.3-Remote-Command-Execution.html x_refsource_MISC
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-7192 government-resource