PT-2019-6063 · Qnap · Qnap Photo Station

Henry Huang · Publicado 2019-12-05 · Atualizado 2025-02-13 · CVE-2019-7195

Positive Technologies (AI Summary)

CVSS v2.0

10

Crítica

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions QNAP Photo Station (affected versions not specified)

Description The issue allows remote attackers to access or modify system files due to an external control of file name or path vulnerability. This vulnerability is related to incorrect limitation of the directory path name with limited access. Exploitation of the vulnerability may allow a remote attacker to compromise data integrity.

Recommendations To fix the vulnerability, update Photo Station to the latest version. As a temporary workaround, consider restricting access to sensitive system files until a patch is available. Avoid using the vulnerable Photo Station application until the issue is resolved.

Exploit

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

BDU:2021-04392

CVE-2019-7195

Produtos afetados

Qnap Photo Station

Referências · 12

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/gather/qnap_lfi.rb · Exploit
• 🔥 https://github.com/cycraft-corp/cve-2019-7192-check · Exploit
• 🔥 http://packetstormsecurity.com/files/157857/QNAP-QTS-And-Photo-Station-6.0.3-Remote-Command-Execution.html · Exploit
• https://t.me/freedomf0x/8080 · Publicação no Telegram
• https://t.me/cvenotify/111198 · Publicação no Telegram
• https://t.me/ckure/4319 · Publicação no Telegram
• https://qnap.com/zh-tw/security-advisory/nas-201911-25 · Aviso do Fabricante
• https://cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-7195 · Nota
• https://packetstormsecurity.com/files/157857/QNAP-QTS-And-Photo-Station-6.0.3-Remote-Command-Execution.html · Nota
• https://osv.dev/vulnerability/CVE-2019-7195 · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2021-04392 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2019-7195 · Nota de Segurança