CVE-2019-7195criticalunder attackransomwareCWE-22

CVE-2019-7195: critical vulnerability in QNAP NAS devices running Photo Station

Published · Updated

Follow this CVE+ Monitor Photo Station+ Monitor NAS devices running Photo Station

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

100Vexday Risk Score

Patch now. It under exploitation confirmed by CISA and has a working public exploit.

ssvc Actcvss 9.8epss 89%
from disclosure to weapon171 days
Published on NVDDec 5
1st PoC+171d
metasploitNov 25
CISA KEV+916d
Action required by CISAfederal deadline: 2022-06-22

Apply updates per vendor instructions.

In short

Photo Station allows remote attackers to access or modify system files by manipulating file paths. This is critical because attackers can read sensitive data or damage system files without needing special permissions.

Technical detail

CWE-22 path traversal vulnerability in Photo Station permits unauthenticated remote attackers to read and write arbitrary files on the system via specially crafted file path parameters. The attack requires only network access and no authentication, enabling complete system compromise.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

This external control of file name or path vulnerability allows remote attackers to access or modify system files. To fix the vulnerability, QNAP recommend updating Photo Station to their latest versions.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
n/a · QNAP NAS devices running Photo Station
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.