Actively exploited · Published Dec 5, 2019 · Assigned by qnap
CVE-2019-7193
Critical 9.8 Exploited Ransomware
In plain English
A critical-severity improper input validation in QNAP NAS devices. Attackers are actively exploiting it in the wild (listed by CISA on June 8, 2022). It has been used in ransomware campaigns. The chance it is exploited in the next 30 days is estimated at 14.4% (higher than 97% of all known vulnerabilities). Apply updates per vendor instructions.
CISA guidance
Apply updates per vendor instructions.
Federal agencies must remediate by Jun 22, 2022.
Official description
This improper input validation vulnerability allows remote attackers to inject arbitrary code to the system. To fix the vulnerability, QNAP recommend updating QTS to their latest versions.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| n/a | QNAP NAS devices | QTS 4.4.0 - QTS 4.4.1: before build 20190918, QTS 4.3.6: before build 20190919 |
Weakness: CWE-20 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://www.qnap.com/zh-tw/security-advisory/nas-201911-25 x_refsource_CONFIRM
- http://packetstormsecurity.com/files/157857/QNAP-QTS-And-Photo-Station-6.0.3-Remote-Command-Execution.html x_refsource_MISC
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-7193 government-resource