critical9.8Known exploited
CVE-2019-7194
QNAP Photo Station Path Traversal Vulnerability
Exploited in the wild
This vulnerability is on a Known Exploited Vulnerabilities catalogue, added 2022-06-08. Federal due date: 2022-06-22.
Apply updates per vendor instructions.
Impact
This external control of file name or path vulnerability allows remote attackers to access or modify system files. To fix the vulnerability, QNAP recommend updating Photo Station to their latest versions.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Qnap | Photo Station | before 6.0.3 before 5.7.10 before 5.4.9 before 5.2.11 |
Weakness classification
References
- NVD record
- CVE.org record
- CISA KEV catalog
- http://packetstormsecurity.com/files/157857/QNAP-QTS-And-Photo-Station-6.0.3-Remote-Command-Execution.html
- https://www.qnap.com/zh-tw/security-advisory/nas-201911-25
- http://packetstormsecurity.com/files/157857/QNAP-QTS-And-Photo-Station-6.0.3-Remote-Command-Execution.html
- https://www.qnap.com/zh-tw/security-advisory/nas-201911-25
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-7194