PT-2019-6309 · Qnap · Qts

Henry Huang · Published 2019-11-25 · Updated 2025-02-13 · CVE-2019-7193

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions QNAP QTS (affected versions not specified)

Description This issue is related to improper input validation, allowing remote attackers to inject arbitrary code into the system. There is no information provided about the estimated number of potentially affected devices worldwide or details about real-world incidents where this issue was exploited.

Recommendations To fix the vulnerability, update QTS to the latest version. As a temporary workaround, consider restricting access to the system to minimize the risk of exploitation. Avoid using the system until the issue is resolved with an update to the latest version. At the moment, there is no information about specific versions that contain a fix for this vulnerability, so updating to the latest version is the recommended course of action.

Exploit

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BDU:2023-00685

CVE-2019-7193

Affected Products

Qts

References · 10

• 🔥 https://github.com/cycraft-corp/cve-2019-7192-check · Exploit
• 🔥 http://packetstormsecurity.com/files/157857/QNAP-QTS-And-Photo-Station-6.0.3-Remote-Command-Execution.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-7193 · Security Note
• https://osv.dev/vulnerability/CVE-2019-7193 · Vendor Advisory
• https://qnap.com/zh-tw/security-advisory/nas-201911-25 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-00685 · Security Note
• https://t.me/cvenotify/110301 · Telegram Post
• https://cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-7193 · Note
• https://cisa.gov/sites/default/files/csv/known_exploited_vulnerabilities.csv · Note
• https://t.me/cvenotify/111196 · Telegram Post