9.8Kritisch
KEV
In Ransomware genutzt
CVE-2019-7194QNAP Photo Station Path Traversal Vulnerability
Bekannt ausgenutzt — QNAP Photo Station Path Traversal Vulnerability
CISA hat am 08.06.2022 bestätigt, dass diese Schwachstelle in echten Angriffen genutzt wird. Frist für US-Bundesbehörden: 22.06.2022.
Erforderliche Maßnahme: Apply updates per vendor instructions. https://nvd.nist.gov/vuln/detail/CVE-2019-7194
Beschreibung
This external control of file name or path vulnerability allows remote attackers to access or modify system files. To fix the vulnerability, QNAP recommend updating Photo Station to their latest versions.
Schwachstellentyp (CWE):
CWE-22
Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.
Betroffene Produkte und Versionen
| Hersteller | Produkt | Versionen | |
|---|---|---|---|
| qnap | photo station | < 6.0.3 | |
| — | QNAP NAS devices running Photo Station | QTS 4.4.1: Photo Station before version 6.0.3, QTS 4.3.4 - QTS 4.4.0: Photo Station before version 5.7.10, QTS 4.3.0 - QTS 4.3.3: Photo Station before version 5.4.9, QTS 4.2.6: Photo Station before version 5.2.11 |
Referenzen und Patches
- https://www.qnap.com/zh-tw/security-advisory/nas-201911-25 Vendor Advisory
- http://packetstormsecurity.com/files/157857/QNAP-QTS-And-Photo-Station-6.0.3-Remote-Command-Execution.html ExploitThird Party AdvisoryVDB Entry
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-7194 US Government Resource
CPE-Treffer (NVD) (4)
cpe:2.3:a:qnap:photo_station:*:*:*:*:*:*:*:*< 6.0.3cpe:2.3:a:qnap:photo_station:*:*:*:*:*:*:*:*< 5.7.10cpe:2.3:a:qnap:photo_station:*:*:*:*:*:*:*:*< 5.4.9cpe:2.3:a:qnap:photo_station:*:*:*:*:*:*:*:*< 5.2.11