PT-2019-6065 · Qnap · Qnap Photo Station

Henry Huang · Publicado 2019-10-25 · Atualizado 2026-02-25 · CVE-2019-7192

Positive Technologies (AI Summary)

CVSS v3.1

10

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions QNAP Photo Station (affected versions not specified)

Description This issue is related to improper access control, allowing remote attackers to gain unauthorized access to the system. The exploitation of this issue can lead to unauthorized system access.

Recommendations To fix this issue, update Photo Station to the latest version. As a temporary workaround, consider restricting access to sensitive system components until the update is applied. Restrict access to the system to minimize the risk of exploitation.

Exploit

Correção

Incorrect Authorization

Improper Privilege Management

Enumeração de Fraquezas

CWE-863

CWE-269

Identificadores relacionados

BDU:2021-04394

CVE-2019-7192

Produtos afetados

Qnap Photo Station

Referências · 18

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/gather/qnap_lfi.rb · Exploit
• 🔥 https://github.com/th3gundy/CVE-2019-7192_QNAP_Exploit · Exploit
• 🔥 https://github.com/cycraft-corp/cve-2019-7192-check · Exploit
• 🔥 http://packetstormsecurity.com/files/157857/QNAP-QTS-And-Photo-Station-6.0.3-Remote-Command-Execution.html · Exploit
• https://t.me/freedomf0x/8080 · Publicação no Telegram
• https://t.me/true_secator/3042 · Publicação no Telegram
• https://t.me/cvenotify/111195 · Publicação no Telegram
• https://t.me/ckure/4319 · Publicação no Telegram
• https://bdu.fstec.ru/vul/2021-04394 · Nota de Segurança
• https://packetstormsecurity.com/files/157857/QNAP-QTS-And-Photo-Station-6.0.3-Remote-Command-Execution.html · Nota
• https://qnap.com/zh-tw/security-advisory/nas-201911-25 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-7192 · Nota de Segurança
• https://cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-7192 · Nota
• https://t.me/aptreports/26183 · Publicação no Telegram
• https://twitter.com/TheInsider_x/status/2026546360917565529 · Publicação no Twitter