CVE-2019-7193 QNAP QTS Improper Input Validation

Exploited in the wild Critical 9.8 Published 5 Dec 2019 Updated 21 Oct 2025

Remote attackers can inject arbitrary code into QNAP NAS devices due to improper input validation, requiring an OS update to mitigate.

Exploited in the wild: Since 8 Jun 2022
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2019-7193?

CVE-2019-7193 is a critical code injection vulnerability in Qnap Qts, published on 5 Dec 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

This improper input validation vulnerability allows remote attackers to inject arbitrary code to the system. To fix the vulnerability, QNAP recommend updating QTS to their latest versions.

Weakness: CWE-20

Which versions are affected by CVE-2019-7193?

It affects 1 product.

Products include Qnap Qts.

How do I fix CVE-2019-7193?

No fix has been published for CVE-2019-7193 yet. Limit exposure of the affected software until one is available. US federal agencies must fix it by 22 Jun 2022.

Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.

Is CVE-2019-7193 being exploited?

Yes. Attackers have exploited CVE-2019-7193 in the wild since at least 8 Jun 2022, including in ransomware campaigns.

All Qnap Qts vulnerabilities

Sources

Also known as GHSA-964w-hfj4-c2g7.