CVE-2019-7193

Timeline

Detection, updates, and resolution for this record.

1. Dec 5, 2019 · Catalog

   Detected

   This improper input validation vulnerability allows remote attackers to inject arbitrary code to the system. To fix the vulnerability, QNAP recommend updating QTS to their latest versions.

2. Jun 8, 2022 · CISA KEV

   Known exploited

   Apply updates per vendor instructions.

3. Jun 22, 2022 · CISA KEV

   Remediation due

   Apply updates per vendor instructions.

4. Jun 16, 2026 · Catalog

   Updated

   This improper input validation vulnerability allows remote attackers to inject arbitrary code to the system. To fix the vulnerability, QNAP recommend updating QTS to their latest versions.

Affected

• cpe qnap/qts4.3.6.0895
• cpe qnap/qts4.3.6.0907
• cpe qnap/qts4.3.6.0923
• cpe qnap/qts4.3.6.0944
• cpe qnap/qts4.3.6.0959
• cpe qnap/qts4.3.6.0979
• cpe qnap/qts4.3.6.0993
• cpe qnap/qts4.3.6.1013
• vendor QNAP QTSversion unspecified

Sources

• CISA KEVCVE-2019-7193

  QNAP QTS contains an improper input validation vulnerability allowing remote attackers to inject code on the system.

  cisa.gov
• CVE.orgCVE-2019-7193

  Official CVE identifier

  cve.org
• FIRST EPSSCVE-2019-7193

  30-day exploitation probability 14.4%

  first.org
• NIST NVDCVE-2019-7193

  This improper input validation vulnerability allows remote attackers to inject arbitrary code to the system. To fix the vulnerability, QNAP recommend updating QTS to their latest versions.

  nvd.nist.gov
• Packet Storm Securityhttp://packetstormsecurity.com/files/157857/QNAP-QTS-And-Photo-Station-6.0.3-Remote-Command-Execution.html

  Packet Storm link already published on the finding.

  packetstormsecurity.com

References

• Exploit · packetstormsecurity.com
• CISA note · nvd.nist.gov
• US Government Resource · cisa.gov
• Vendor Advisory · qnap.com