Live › vulnerability › CVE-2019-7193
Go to dashboardQNAP QTS, the operating system on QNAP network-attached storage devices, has an input validation flaw that lets remote attackers inject code. The sources say attackers have exploited it in the wild and that it has been used in ransomware campaigns.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:11 UTC, 3h before NVD. All times on this page are UTC.
Apply updates per vendor instructions.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| QNAP QTS | vendor | – | – |
| qnap qts | vendor | = 4.3.6.0895 | – |
| qnap qts | vendor | = 4.3.6.0907 | – |
| qnap qts | vendor | = 4.3.6.0923 | – |
| qnap qts | vendor | = 4.3.6.0944 | – |
| qnap qts | vendor | = 4.3.6.0959 | – |
| qnap qts | vendor | = 4.3.6.0979 | – |
| qnap qts | vendor | = 4.3.6.0993 | – |
| qnap qts | vendor | = 4.3.6.1013 | – |
| qnap qts | vendor | = 4.3.6.1033 | – |
| qnap qts | vendor | = 4.4.1.0948 | – |
| qnap qts | vendor | = 4.4.1.0949 | – |
| qnap qts | vendor | = 4.4.1.0978 | – |
| qnap qts | vendor | = 4.4.1.0998 | – |
| qnap qts | vendor | = 4.4.1.0999 | – |
| qnap qts | vendor | = 4.4.1.1031 | – |
| qnap qts | vendor | = 4.4.1.1033 | – |
Check the QTS version in the web admin under Control Panel > System > Firmware Update; compare it against the fixed build in the QNAP advisory.
Update QTS to the fixed build listed in the QNAP security advisory, following CISA's instruction to apply vendor updates.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
This improper input validation vulnerability allows remote attackers to inject arbitrary code to the system. To fix the vulnerability, QNAP recommend updating QTS to their latest versions.
This page as .md · .json · in your agent: get_signal("CVE-2019-7193")
CISA KEV catalog, Creative Commons 0 · EPSS scores by FIRST, used with attribution · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.