CVE-2019-7194: QNAP Photo Station Path Traversal Vulnerability
CVE-2019-7194 · Severity: critical · CVSS 9.8 · Exploited in the wild · Published 2022-06-08
A path traversal vulnerability in QNAP Photo Station allows remote attackers to access or modify system files via external control of file names or paths. This vulnerability can be leveraged to achieve remote command execution.
Yes. CVE-2019-7194 is known to be exploited in the wild, first recorded on 8 June 2022. Treat it as urgent.
How severe is CVE-2019-7194?
Critical severity, with a CVSS score of 9.8, published 8 June 2022.
Which products and versions are affected?
QNAP Systems, Inc. Photo Station < 5.2.11 (on QTS 4.2.6); QNAP Systems, Inc. Photo Station < 5.4.9 (on QTS 4.3.0 - 4.3.3); QNAP Systems, Inc. Photo Station < 5.7.10 (on QTS 4.3.4 - 4.4.0); QNAP Systems, Inc. Photo Station < 6.0.3 (on QTS 4.4.1).
Is there a fix for CVE-2019-7194?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2019-7194 attacked?
It is attacked over the network, in a network appliance.
Am I affected by CVE-2019-7194?
Check whether you run QNAP Photo Station. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Affected products
QNAP Systems, Inc. Photo Station < 5.2.11 (on QTS 4.2.6)
QNAP Systems, Inc. Photo Station < 5.4.9 (on QTS 4.3.0 - 4.3.3)
QNAP Systems, Inc. Photo Station < 5.7.10 (on QTS 4.3.4 - 4.4.0)
QNAP Systems, Inc. Photo Station < 6.0.3 (on QTS 4.4.1)
Timeline
2019-12-05: disclosed: NVD Published Date
2022-06-08: kev added: Added to CISA Known Exploited Vulnerabilities Catalog
2020-05-28: other: Public exploit published on Packet Storm Security