Actively exploited in the wild
QNAP Photo Station Improper Access Control Vulnerability
QNAP - Photo Station · Listed in the CISA KEV since 2022-06-08. This indicates confirmed attacks in production environments.
Required action: Apply updates per vendor instructions.
CVE-2019-7192
CriticalCVSS 9.8KEVSummary
This improper access control vulnerability allows remote attackers to gain unauthorized access to the system. To fix these vulnerabilities, QNAP recommend updating Photo Station to their latest versions.
Risk Assessment
An attacker could gain unauthorized access to the system, potentially leading to data confidentiality breaches and further privilege escalation. This may result in full control over the device.
Recommendation
Update Photo Station to the latest version provided by QNAP. Additionally, verify whether any unauthorized access has occurred.
Other vulnerabilities in QNAP Photo Station
See all- CVE-2022-27593CriticalActively exploited
An externally controlled reference to a resource vulnerability has been reported to affect QNAP NAS running Photo Station. If exploited, this could allow an attacker to modify system files. The vulnerability has been fixed in specific versions of Photo Station for various QTS versions.
- CVE-2019-7195CriticalActively exploited
This external control of file name or path vulnerability allows remote attackers to access or modify system files. To fix the vulnerability, QNAP recommend updating Photo Station to their latest versions.
- CVE-2019-7194CriticalActively exploited
This external control of file name or path vulnerability allows remote attackers to access or modify system files. To fix the vulnerability, QNAP recommend updating Photo Station to their latest versions.
Original NVD description (English source)
This improper access control vulnerability allows remote attackers to gain unauthorized access to the system. To fix these vulnerabilities, QNAP recommend updating Photo Station to their latest versions.