CVE-2019-7192

Timeline

Detection, updates, and resolution for this record.

1. Dec 5, 2019 · Catalog

   Detected

   This improper access control vulnerability allows remote attackers to gain unauthorized access to the system. To fix these vulnerabilities, QNAP recommend updating Photo Station to their latest versions.

2. Jun 8, 2022 · CISA KEV

   Known exploited

   Apply updates per vendor instructions.

3. Jun 22, 2022 · CISA KEV

   Remediation due

   Apply updates per vendor instructions.

4. Jun 16, 2026 · Catalog

   Updated

   This improper access control vulnerability allows remote attackers to gain unauthorized access to the system. To fix these vulnerabilities, QNAP recommend updating Photo Station to their latest versions.

Affected

• cpe qnap/photo stationversion unspecified
• vendor QNAP Photo Stationversion unspecified

Sources

• CISA KEVCVE-2019-7192

  QNAP NAS devices running Photo Station contain an improper access control vulnerability allowing remote attackers to gain unauthorized access to the system.

  cisa.gov
• CVE.orgCVE-2019-7192

  Official CVE identifier

  cve.org
• FIRST EPSSCVE-2019-7192

  30-day exploitation probability 88.1%

  first.org
• Metasploit Modulesauxiliary_gather/qnap_lfi

  Public module reference (normal). Module source is not copied into this catalog.

  rapid7.com
• NIST NVDCVE-2019-7192

  This improper access control vulnerability allows remote attackers to gain unauthorized access to the system. To fix these vulnerabilities, QNAP recommend updating Photo Station to their latest versions.

  nvd.nist.gov
• Packet Storm Securityhttp://packetstormsecurity.com/files/157857/QNAP-QTS-And-Photo-Station-6.0.3-Remote-Command-Execution.html

  Packet Storm link already published on the finding.

  packetstormsecurity.com

References

• Exploit · packetstormsecurity.com
• CISA note · nvd.nist.gov
• US Government Resource · cisa.gov
• Vendor Advisory · qnap.com