---
id: "CVE-2019-7192"
kind: "vulnerability"
aliases: ["CVE-2019-7192"]
title: "qnap photo station: This improper access control vulnerability allows remote attackers to gain unauthorized access to the system"
severity: "critical"
cvss: 9.8
epss: 0.88102
exploited: true
status: "open"
category: "infrastructure"
products: [{"name": "qnap photo station", "fixed": ["6.0.3"], "affected": "< 6.0.3", "ecosystem": "vendor"}, {"name": "qnap photo station", "fixed": ["5.7.10"], "affected": "< 5.7.10", "ecosystem": "vendor"}, {"name": "qnap photo station", "fixed": ["5.4.9"], "affected": "< 5.4.9", "ecosystem": "vendor"}, {"name": "qnap photo station", "fixed": ["5.2.11"], "affected": "< 5.2.11", "ecosystem": "vendor"}, {"name": "QNAP Photo Station", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["exploited", "infrastructure", "nas", "photo-station", "qnap", "ransomware", "self-hosted"]
not_affected_if: ["no-photo-station", "not-internet-exposed"]
published_at: "2019-12-05T17:15:12+00:00"
first_seen_at: "2026-10-23T19:11:52+00:00"
updated_at: "2026-10-24T00:09:51+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2019-7192", "first_seen_at": "2026-10-23T19:11:52+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2019-7192", "first_seen_at": "2026-10-23T19:13:45+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-7192", "first_seen_at": "2026-10-23T22:29:04+00:00"}]
---

# qnap photo station: This improper access control vulnerability allows remote attackers to gain unauthorized access to the system

QNAP NAS devices running Photo Station have an improper access control flaw that lets remote attackers reach the system without authorization. CISA lists it as actively exploited in the wild, and the KEV entry notes ransomware use.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:qnap photo station affected < 6.0.3 fixed 6.0.3
- vendor:qnap photo station affected < 5.7.10 fixed 5.7.10
- vendor:qnap photo station affected < 5.4.9 fixed 5.4.9
- vendor:qnap photo station affected < 5.2.11 fixed 5.2.11
- vendor:QNAP Photo Station affected ? fixed ?

## Fix

Apply the QNAP update for Photo Station per vendor instructions; the sources do not name the fixed version.

## Timeline

- 2026-10-23T19:11:52+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2019-7192
- 2026-10-23T19:13:45+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2019-7192
- 2026-10-23T22:29:04+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2019-7192

## From the sources

QNAP NAS devices running Photo Station contain an improper access control vulnerability allowing remote attackers to gain unauthorized access to the system.

CISA required action: Apply updates per vendor instructions.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_