Actively exploited in the wild
QNAP Photo Station Path Traversal Vulnerability
QNAP - Photo Station · Listed in the CISA KEV since 2022-06-08. This indicates confirmed attacks in production environments.
Required action: Apply updates per vendor instructions.
CVE-2019-7195
CriticalCVSS 9.8KEVSummary
This external control of file name or path vulnerability allows remote attackers to access or modify system files. To fix the vulnerability, QNAP recommend updating Photo Station to their latest versions.
Risk Assessment
Potential for unauthorized access or modification of system files by a remote attacker.
Recommendation
Update QNAP Photo Station to the latest version as recommended by the vendor.
Other vulnerabilities in QNAP Photo Station
See all- CVE-2022-27593CriticalActively exploited
An externally controlled reference to a resource vulnerability has been reported to affect QNAP NAS running Photo Station. If exploited, this could allow an attacker to modify system files. The vulnerability has been fixed in specific versions of Photo Station for various QTS versions.
- CVE-2019-7194CriticalActively exploited
This external control of file name or path vulnerability allows remote attackers to access or modify system files. To fix the vulnerability, QNAP recommend updating Photo Station to their latest versions.
- CVE-2019-7192CriticalActively exploited
This improper access control vulnerability allows remote attackers to gain unauthorized access to the system. To fix these vulnerabilities, QNAP recommend updating Photo Station to their latest versions.
Original NVD description (English source)
This external control of file name or path vulnerability allows remote attackers to access or modify system files. To fix the vulnerability, QNAP recommend updating Photo Station to their latest versions.