CVE-2019-7192 QNAP Photo Station Improper Access Control

What is CVE-2019-7192?

CVE-2019-7192 is a critical missing authorization vulnerability in QNAP NAS devices running Photo Station, published on 5 Dec 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

This improper access control vulnerability allows remote attackers to gain unauthorized access to the system. To fix these vulnerabilities, QNAP recommend updating Photo Station to their latest versions.

Weakness: CWE-863

Which versions are affected by CVE-2019-7192?

It affects 1 product.

Products include Qnap Photo Station.

How do I fix CVE-2019-7192?

No fix has been published for CVE-2019-7192 yet. Limit exposure of the affected software until one is available. US federal agencies must fix it by 22 Jun 2022.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2019-7192 being exploited?

Yes. Attackers have exploited CVE-2019-7192 in the wild since at least 8 Jun 2022, including in ransomware campaigns.

Public exploit code: 1 Metasploit module, 1 Nuclei template and 2 proofs of concept on GitHub.

Other vulnerabilities in QNAP NAS devices running Photo Station

• CVE-2022-27593 QNAP Photo Station Externally Controlled Reference Exploited Critical 10.0
• CVE-2019-7194 QNAP Photo Station Path Traversal Exploited Critical 9.8
• CVE-2019-7195 QNAP Photo Station Path Traversal Exploited Critical 9.8
• CVE-2017-20210 Photo Station Critical 9.8
• CVE-2021-34354 Stored Cross-site Scripting Vulnerability in Photo Station High 7.6

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-9p75-w4p8-7gvx.