{"id":"CVE-2019-7192","kind":"vulnerability","aliases":["CVE-2019-7192"],"related":[],"title":"qnap photo station: This improper access control vulnerability allows remote attackers to gain unauthorized access to the system","description":"QNAP NAS devices running Photo Station contain an improper access control vulnerability allowing remote attackers to gain unauthorized access to the system.\n\nCISA required action: Apply updates per vendor instructions.","summary":"QNAP NAS devices running Photo Station have an improper access control flaw that lets remote attackers reach the system without authorization. CISA lists it as actively exploited in the wild, and the KEV entry notes ransomware use.","severity":"critical","cvss":9.8,"epss":0.88102,"exploited":true,"exploited_at":"2022-06-08T00:00:00+00:00","products":[{"name":"qnap photo station","fixed":["6.0.3"],"affected":"< 6.0.3","ecosystem":"vendor"},{"name":"qnap photo station","fixed":["5.7.10"],"affected":"< 5.7.10","ecosystem":"vendor"},{"name":"qnap photo station","fixed":["5.4.9"],"affected":"< 5.4.9","ecosystem":"vendor"},{"name":"qnap photo station","fixed":["5.2.11"],"affected":"< 5.2.11","ecosystem":"vendor"},{"name":"QNAP Photo Station","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["exploited","infrastructure","nas","photo-station","qnap","ransomware","self-hosted"],"not_affected_if":["no-photo-station","not-internet-exposed"],"how_to_check":null,"fix":"Apply the QNAP update for Photo Station per vendor instructions; the sources do not name the fixed version.","status":"open","published_at":"2019-12-05T17:15:12+00:00","first_seen_at":"2026-10-23T19:11:52+00:00","triaged_at":"2026-10-23T21:12:48+00:00","updated_at":"2026-10-24T00:09:51+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-23T21:12:48Z","model":"claude-haiku-5-5","output":{"fix":"Apply the QNAP update for Photo Station per vendor instructions; the sources do not name the fixed version.","reach":"internet","impact":"high","summary":"QNAP NAS devices running Photo Station have an improper access control flaw that lets remote attackers reach the system without authorization. CISA lists it as actively exploited in the wild, and the KEV entry notes ransomware use.","category":"infrastructure","who_cares":["qnap","nas","photo-station","self-hosted"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker gains unauthorized access to the NAS, possibly with ransomware deployed.","analyst_note":"Find the affected and fixed Photo Station versions and the QNAP advisory from the CISA KEV entry or QNAP security bulletins, and check whether authentication is required.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["no-photo-station","not-internet-exposed"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000469,"input_tokens":2833,"output_tokens":372,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2019':20A,23A '-7192':21A,24A 'access':6A,15A,60B,97C,106C 'action':112C 'activ':76B 'allow':9A,100C 'appli':113C 'attack':11A,66B,102C 'author':71B 'cisa':72B,110C 'contain':94C 'control':7A,61B,98C 'cve':19A,22A 'devic':53B,90C 'entri':84B 'exploit':40B,77B 'flaw':62B 'gain':13A,104C 'host':50B 'improp':5A,59B,96C 'infrastructur':41B 'instruct':117C 'kev':83B 'let':64B 'list':73B 'nas':42B,52B,89C 'note':85B 'per':115C 'photo':2A,26A,29A,32A,35A,38A,44B,55B,92C 'photo-st':43B 'qnap':1A,25A,28A,31A,34A,37A,46B,51B,88C 'ransomwar':47B,86B 'reach':67B 'remot':10A,65B,101C 'requir':111C 'run':54B,91C 'self':49B 'self-host':48B 'station':3A,27A,30A,33A,36A,39A,45B,56B,93C 'system':18A,69B,109C 'unauthor':14A,105C 'updat':114C 'use':87B 'vendor':116C 'vulner':8A,99C 'wild':80B 'without':70B","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2019-12-05T17:15:12+00:00","kev":{"dateAdded":"2022-06-08","dueDate":"2022-06-22","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"Known"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2019-7192","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2019-7192","severity":null,"published_at":"2022-06-08T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:52+00:00","fetched_at":"2026-10-25T10:39:06+00:00","note":null},{"source":"epss","external_id":"CVE-2019-7192","url":"https://api.first.org/data/v1/epss?cve=CVE-2019-7192","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:45+00:00","fetched_at":"2026-10-23T19:13:45+00:00","note":null},{"source":"nvd","external_id":"CVE-2019-7192","url":"https://nvd.nist.gov/vuln/detail/CVE-2019-7192","severity":null,"published_at":"2019-12-05T17:15:12+00:00","modified_at":"2026-06-17T02:40:14+00:00","first_seen_at":"2026-10-23T22:29:04+00:00","fetched_at":"2026-10-23T22:29:04+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}