Paper/Archive/CVE-2019-7193

CVE-2019-7193

QNAP QTS — QNAP QTS Improper Input Validation Vulnerability

KEV · due 22 Jun ransomware use EPSS 14%public exploit SSVC act CVSS 9.8

CVSS 9.8 (ADP)9.8 / 10 × 3029.4 In CISA KEV+3030.0 EPSS percentile 96.6.966 × 2019.3 Exploit: SSVC active+1010.0 SSVC exploitation: active+1010.0

Description · from the CVE record

This improper input validation vulnerability allows remote attackers to inject arbitrary code to the system. To fix the vulnerability, QNAP recommend updating QTS to their latest versions.

Affected

ProductAffectedFixed inSource

QNAP NAS devicesQTS 4.4.0 - QTS 4.4.1: before build 20190918, QTS 4.3.6: before build 20190919–CNA

Scores by source

CISA ADP9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA ADPSSVCExploitation: active · Automatable: yes · Technical impact: total

References

refqnap.com/zh-tw/security-advisory/nas-201911-25 refpacketstormsecurity.com/files/157857/QNAP-QTS-And-Photo-Station-6.0.3-Remote-Command-Execution.html refcisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-7193 kevcisa.gov/known-exploited-vulnerabilities-catalog