CVE-2019-7192criticalunder attackransomwareCWE-863

CVE-2019-7192: critical vulnerability in QNAP NAS devices running Photo Station

Published · Updated

Follow this CVE+ Monitor Photo Station+ Monitor NAS devices running Photo Station

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

100Vexday Risk Score

Patch now. It under exploitation confirmed by CISA and has a working public exploit.

ssvc Actcvss 9.8epss 88%
from disclosure to weapon168 days
Published on NVDDec 5
1st PoC+168d
metasploitNov 25
CISA KEV+916d
Action required by CISAfederal deadline: 2022-06-22

Apply updates per vendor instructions.

In short

Photo Station has a flaw that lets remote attackers bypass access controls and gain unauthorized access to the system without proper authentication. This is critical because attackers can take control of the affected system from the internet.

Technical detail

CWE-863 improper access control vulnerability in Photo Station allows remote attackers to bypass authentication mechanisms and gain unauthorized system access. The vulnerability requires network access but no user interaction, resulting in complete compromise of system confidentiality, integrity, and availability.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

This improper access control vulnerability allows remote attackers to gain unauthorized access to the system. To fix these vulnerabilities, QNAP recommend updating Photo Station to their latest versions.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
n/a · QNAP NAS devices running Photo Station
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.