9.8Critical
KEV
Used in ransomware
CVE-2019-7193QNAP QTS Improper Input Validation Vulnerability
Known exploited — QNAP QTS Improper Input Validation Vulnerability
CISA confirmed this vulnerability is used in real attacks on 08.06.2022. Remediation deadline for US federal agencies: 22.06.2022.
Required action: Apply updates per vendor instructions. https://nvd.nist.gov/vuln/detail/CVE-2019-7193
Description
This improper input validation vulnerability allows remote attackers to inject arbitrary code to the system. To fix the vulnerability, QNAP recommend updating QTS to their latest versions.
Weakness (CWE):
CWE-20
Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.
Affected products and versions
References and patches
- https://www.qnap.com/zh-tw/security-advisory/nas-201911-25 Vendor Advisory
- http://packetstormsecurity.com/files/157857/QNAP-QTS-And-Photo-Station-6.0.3-Remote-Command-Execution.html ExploitThird Party AdvisoryVDB Entry
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-7193 US Government Resource
CPE matches (NVD) (16)
cpe:2.3:o:qnap:qts:4.3.6.0895:-:*:*:*:*:*:*cpe:2.3:o:qnap:qts:4.3.6.0907:-:*:*:*:*:*:*cpe:2.3:o:qnap:qts:4.3.6.0923:-:*:*:*:*:*:*cpe:2.3:o:qnap:qts:4.3.6.0944:-:*:*:*:*:*:*cpe:2.3:o:qnap:qts:4.3.6.0959:-:*:*:*:*:*:*cpe:2.3:o:qnap:qts:4.3.6.0979:-:*:*:*:*:*:*cpe:2.3:o:qnap:qts:4.3.6.0993:-:*:*:*:*:*:*cpe:2.3:o:qnap:qts:4.3.6.1013:-:*:*:*:*:*:*cpe:2.3:o:qnap:qts:4.3.6.1033:-:*:*:*:*:*:*cpe:2.3:o:qnap:qts:4.4.1.0948:beta:*:*:*:*:*:*cpe:2.3:o:qnap:qts:4.4.1.0949:beta:*:*:*:*:*:*cpe:2.3:o:qnap:qts:4.4.1.0978:beta_2:*:*:*:*:*:*cpe:2.3:o:qnap:qts:4.4.1.0998:beta_3:*:*:*:*:*:*cpe:2.3:o:qnap:qts:4.4.1.0999:beta_3:*:*:*:*:*:*cpe:2.3:o:qnap:qts:4.4.1.1031:beta_4:*:*:*:*:*:*cpe:2.3:o:qnap:qts:4.4.1.1033:beta_4:*:*:*:*:*:*