Paper/Archive/CVE-2019-7192

CVE-2019-7192

QNAP Photo Station — QNAP Photo Station Improper Access Control Vulnerability

KEV · due 22 Jun ransomware use EPSS 88%public exploit SSVC act CVSS 9.8

CVSS 9.8 (ADP)9.8 / 10 × 3029.4 In CISA KEV+3030.0 EPSS percentile 99.8.998 × 2020.0 Exploit: SSVC active+1010.0 SSVC exploitation: active+1010.0

Description · from the CVE record

This improper access control vulnerability allows remote attackers to gain unauthorized access to the system. To fix these vulnerabilities, QNAP recommend updating Photo Station to their latest versions.

Affected

ProductAffectedFixed inSource

QNAP NAS devices running Photo StationQTS 4.4.1: Photo Station before version 6.0.3, QTS 4.3.4 - QTS 4.4.0: Photo Station before version 5.7.10, QTS 4.3.0 - QTS 4.3.3: Photo Station before version 5.4.9, QTS 4.2.6: Photo Station before version 5.2.11–CNA

Scores by source

CISA ADP9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA ADPSSVCExploitation: active · Automatable: yes · Technical impact: total

References

refqnap.com/zh-tw/security-advisory/nas-201911-25 refpacketstormsecurity.com/files/157857/QNAP-QTS-And-Photo-Station-6.0.3-Remote-Command-Execution.html refcisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-7192 kevcisa.gov/known-exploited-vulnerabilities-catalog