Paper/Archive/CVE-2019-7195

CVE-2019-7195

QNAP Photo Station — QNAP Photo Station Path Traversal Vulnerability

KEV · due 22 Jun ransomware use EPSS 89%public exploit SSVC act CVSS 9.8

CVSS 9.8 (ADP)9.8 / 10 × 3029.4 In CISA KEV+3030.0 EPSS percentile 99.8.998 × 2020.0 Exploit: SSVC active+1010.0 SSVC exploitation: active+1010.0

Description · from the CVE record

This external control of file name or path vulnerability allows remote attackers to access or modify system files. To fix the vulnerability, QNAP recommend updating Photo Station to their latest versions.

Affected

ProductAffectedFixed inSource

QNAP NAS devices running Photo StationQTS 4.4.1: Photo Station before version 6.0.3, QTS 4.3.4 - QTS 4.4.0: Photo Station before version 5.7.10, QTS 4.3.0 - QTS 4.3.3: Photo Station before version 5.4.9, QTS 4.2.6: Photo Station before version 5.2.11–CNA

Scores by source

CISA ADP9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA ADPSSVCExploitation: active · Automatable: yes · Technical impact: total

References

refqnap.com/zh-tw/security-advisory/nas-201911-25 refpacketstormsecurity.com/files/157857/QNAP-QTS-And-Photo-Station-6.0.3-Remote-Command-Execution.html refcisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-7195 kevcisa.gov/known-exploited-vulnerabilities-catalog