CVE-2019-7194

Timeline

Detection, updates, and resolution for this record.

1. Dec 5, 2019 · Catalog

   Detected

   This external control of file name or path vulnerability allows remote attackers to access or modify system files. To fix the vulnerability, QNAP recommend updating Photo Station to their latest versions.

2. Jun 8, 2022 · CISA KEV

   Known exploited

   Apply updates per vendor instructions.

3. Jun 22, 2022 · CISA KEV

   Remediation due

   Apply updates per vendor instructions.

4. Jun 16, 2026 · Catalog

   Updated

   This external control of file name or path vulnerability allows remote attackers to access or modify system files. To fix the vulnerability, QNAP recommend updating Photo Station to their latest versions.

Affected

• cpe qnap/photo stationversion unspecified
• vendor QNAP Photo Stationversion unspecified

Sources

• CISA KEVCVE-2019-7194

  QNAP devices running Photo Station contain an external control of file name or path vulnerability allowing remote attackers to access or modify system files.

  cisa.gov
• CVE.orgCVE-2019-7194

  Official CVE identifier

  cve.org
• FIRST EPSSCVE-2019-7194

  30-day exploitation probability 83.1%

  first.org
• Metasploit Modulesauxiliary_gather/qnap_lfi

  Public module reference (normal). Module source is not copied into this catalog.

  rapid7.com
• NIST NVDCVE-2019-7194

  This external control of file name or path vulnerability allows remote attackers to access or modify system files. To fix the vulnerability, QNAP recommend updating Photo Station to their latest versions.

  nvd.nist.gov
• Packet Storm Securityhttp://packetstormsecurity.com/files/157857/QNAP-QTS-And-Photo-Station-6.0.3-Remote-Command-Execution.html

  Packet Storm link already published on the finding.

  packetstormsecurity.com

References

• Exploit · packetstormsecurity.com
• CISA note · nvd.nist.gov
• US Government Resource · cisa.gov
• Vendor Advisory · qnap.com