PT-2019-6064 · Qnap · Qnap Photo Station

Henry Huang · Published 2019-10-25 · Updated 2025-02-13 · CVE-2019-7194

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions QNAP Photo Station (affected versions not specified)

Description This issue allows remote attackers to access or modify system files due to external control of file name or path. It is related to incorrect limitation of the directory path name with limited access. Exploitation may allow a remote attacker to compromise data integrity.

Recommendations To fix the vulnerability, update Photo Station to the latest version. As a temporary workaround, consider restricting access to sensitive system files until the update is applied. Avoid using the vulnerable Photo Station version until it is updated to the latest version.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

BDU:2021-04393

CVE-2019-7194

Affected Products

Qnap Photo Station

References · 10

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/gather/qnap_lfi.rb · Exploit
• 🔥 https://github.com/cycraft-corp/cve-2019-7192-check · Exploit
• 🔥 http://packetstormsecurity.com/files/157857/QNAP-QTS-And-Photo-Station-6.0.3-Remote-Command-Execution.html · Exploit
• https://bdu.fstec.ru/vul/2021-04393 · Security Note
• https://osv.dev/vulnerability/CVE-2019-7194 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-7194 · Security Note
• https://qnap.com/zh-tw/security-advisory/nas-201911-25 · Vendor Advisory
• https://cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-7194 · Note
• https://t.me/cvenotify/111197 · Telegram Post
• https://packetstormsecurity.com/files/157857/QNAP-QTS-And-Photo-Station-6.0.3-Remote-Command-Execution.html · Note