---
id: "CVE-2019-7193"
kind: "vulnerability"
aliases: ["CVE-2019-7193"]
title: "qnap qts: This improper input validation vulnerability allows remote attackers to inject arbitrary code to the system"
severity: "critical"
cvss: 10.0
epss: 0.14367
exploited: true
status: "open"
category: "vendor"
products: [{"name": "QNAP QTS", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "qnap qts", "fixed": [], "affected": "= 4.3.6.0895", "ecosystem": "vendor"}, {"name": "qnap qts", "fixed": [], "affected": "= 4.3.6.0907", "ecosystem": "vendor"}, {"name": "qnap qts", "fixed": [], "affected": "= 4.3.6.0923", "ecosystem": "vendor"}, {"name": "qnap qts", "fixed": [], "affected": "= 4.3.6.0944", "ecosystem": "vendor"}, {"name": "qnap qts", "fixed": [], "affected": "= 4.3.6.0959", "ecosystem": "vendor"}, {"name": "qnap qts", "fixed": [], "affected": "= 4.3.6.0979", "ecosystem": "vendor"}, {"name": "qnap qts", "fixed": [], "affected": "= 4.3.6.0993", "ecosystem": "vendor"}, {"name": "qnap qts", "fixed": [], "affected": "= 4.3.6.1013", "ecosystem": "vendor"}, {"name": "qnap qts", "fixed": [], "affected": "= 4.3.6.1033", "ecosystem": "vendor"}, {"name": "qnap qts", "fixed": [], "affected": "= 4.4.1.0948", "ecosystem": "vendor"}, {"name": "qnap qts", "fixed": [], "affected": "= 4.4.1.0949", "ecosystem": "vendor"}, {"name": "qnap qts", "fixed": [], "affected": "= 4.4.1.0978", "ecosystem": "vendor"}, {"name": "qnap qts", "fixed": [], "affected": "= 4.4.1.0998", "ecosystem": "vendor"}, {"name": "qnap qts", "fixed": [], "affected": "= 4.4.1.0999", "ecosystem": "vendor"}, {"name": "qnap qts", "fixed": [], "affected": "= 4.4.1.1031", "ecosystem": "vendor"}, {"name": "qnap qts", "fixed": [], "affected": "= 4.4.1.1033", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["exploited", "nas", "qnap", "qts", "ransomware", "self-hosted", "vendor"]
not_affected_if: ["managed-hosting"]
published_at: "2019-12-05T17:15:13+00:00"
first_seen_at: "2026-10-23T19:11:52+00:00"
updated_at: "2026-10-23T22:29:04+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2019-7193", "first_seen_at": "2026-10-23T19:11:52+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2019-7193", "first_seen_at": "2026-10-23T19:13:45+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-7193", "first_seen_at": "2026-10-23T22:29:04+00:00"}]
---

# qnap qts: This improper input validation vulnerability allows remote attackers to inject arbitrary code to the system

QNAP QTS, the operating system on QNAP network-attached storage devices, has an input validation flaw that lets remote attackers inject code. The sources say attackers have exploited it in the wild and that it has been used in ransomware campaigns.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:QNAP QTS affected ? fixed ?
- vendor:qnap qts affected = 4.3.6.0895 fixed ?
- vendor:qnap qts affected = 4.3.6.0907 fixed ?
- vendor:qnap qts affected = 4.3.6.0923 fixed ?
- vendor:qnap qts affected = 4.3.6.0944 fixed ?
- vendor:qnap qts affected = 4.3.6.0959 fixed ?
- vendor:qnap qts affected = 4.3.6.0979 fixed ?
- vendor:qnap qts affected = 4.3.6.0993 fixed ?
- vendor:qnap qts affected = 4.3.6.1013 fixed ?
- vendor:qnap qts affected = 4.3.6.1033 fixed ?
- vendor:qnap qts affected = 4.4.1.0948 fixed ?
- vendor:qnap qts affected = 4.4.1.0949 fixed ?
- vendor:qnap qts affected = 4.4.1.0978 fixed ?
- vendor:qnap qts affected = 4.4.1.0998 fixed ?
- vendor:qnap qts affected = 4.4.1.0999 fixed ?
- vendor:qnap qts affected = 4.4.1.1031 fixed ?
- vendor:qnap qts affected = 4.4.1.1033 fixed ?

## How to check

Check the QTS version in the web admin under Control Panel > System > Firmware Update; compare it against the fixed build in the QNAP advisory.

## Fix

Update QTS to the fixed build listed in the QNAP security advisory, following CISA's instruction to apply vendor updates.

## Timeline

- 2026-10-23T19:11:52+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2019-7193
- 2026-10-23T19:13:45+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2019-7193
- 2026-10-23T22:29:04+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2019-7193

## From the sources

This improper input validation vulnerability allows remote attackers to inject arbitrary code to the system. To fix the vulnerability, QNAP recommend updating QTS to their latest versions.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_