CVE DatabaseCVE-2019-7193

Updated 2026-06-17한국어 권고문 →

CVE-2019-71939.8/CRITICALCISA KEVCWE-20

QNAP QTS and Photo Station Remote Code Execution (RCE) Vulnerability due to Improper Input Validation (CVE-2019-7193)

⚡ Jump to Patch

Affected Vendors

qnap

Affected Components

qts, photo station

Published Date

2019-12-05

CVSS v3.1

9.8

CRITICAL

EPSS (30d)

14.4%

FIRST.org

CISA KEV

Exploited

NVD Source ↗

Executive & SecOps Summary

SECOPS ASSESSMENT

Affected Scope

QNAP QTS operating system and Photo Station application

Impact

Unauthenticated remote attackers can inject arbitrary system commands via crafted HTTP requests, leading to complete system compromise

Mitigation

Immediately update QTS and Photo Station to the latest patched versions recommended by QNAP

Affected Products & Version Scope

QNAP QTS and Photo Station versions 6.0.3 and prior

Remediation & Live Workaround Commands

PATCH & WORKAROUND

1. Official Patch & Version Upgrade Commands

Update QTS and Photo Station to the latest secure versions via the QTS Control Panel immediately. To check the current firmware and package status via SSH, use the following commands:

bash

# Check QTS firmware version
getcfg system version

# Check Photo Station installation and version
/sbin/qpkg_cli --info PhotoStation

2. Temporary Workaround & Hardening Configuration

If immediate patching is not feasible, restrict external access to the QNAP administration and Photo Station interfaces. If using a reverse proxy like Nginx, apply access controls to block unauthorized external requests:

nginx

# Restrict access to Photo Station endpoints
location /photo/ {
    allow 10.0.0.0/8;
    deny all;
}

3. Log Audit & IoC Verification Commands

Inspect the web server access logs for suspicious command injection patterns or unusual request payloads:

bash

# Search for suspicious command execution patterns in Apache access logs
grep -Ei '(sh|bash|curl|wget|python|perl|eval)' /mnt/ext/opt/apache/logs/access_log

Interactive SecOps Remediation Checklist

0/4 (0%)

Recommended Security Control & Mitigation Partner

Cloudflare Enterprise & Pro WAF

Due to active exploitation in the wild, immediately apply the latest security updates to your QNAP QTS and Photo Station installations.

Block Exploits Instantly with Managed Virtual Patching Rules

Can't patch production immediately? Deploy managed WAF rules at the edge to intercept RCE, SQLi, and deserialization payloads before they hit your origin server.

3-min setup · Automated Zero-Day Managed Rules

Deploy Instant WAF Protection Free

Practice Exploiting & Patching This Web Vulnerability in an Interactive Lab

Launch Hands-On Security Lab

Technical Root Cause & Exploitation Mechanics

1. Vulnerability Overview & Root Cause

This vulnerability (CVE-2019-7193) is a critical improper input validation flaw (CWE-20) residing in QNAP QTS and the Photo Station application. The root cause is the lack of sufficient sanitization and validation of user-supplied inputs before processing them within system execution contexts.

2. Exploitation Mechanics & Attack Scenario

An unauthenticated remote attacker can exploit this vulnerability by sending specially crafted HTTP requests to the vulnerable QNAP device, specifically targeting Photo Station endpoints. Due to the improper validation, the malicious payload bypasses security checks and is executed directly on the operating system shell. This vulnerability has been actively exploited in the wild and is listed in the CISA KEV catalog.

3. Infrastructure & Business Impact

With a CVSS score of 9.8 (Critical), the impact of successful exploitation is severe. Attackers can gain full administrative control over the NAS device, allowing them to exfiltrate, modify, or delete sensitive business data. Furthermore, compromised NAS devices are frequently used as entry points for lateral movement within internal networks or as targets for ransomware deployment.

Official Vendor Advisories & References

NVD Original English Description

This improper input validation vulnerability allows remote attackers to inject arbitrary code to the system. To fix the vulnerability, QNAP recommend updating QTS to their latest versions.

http://packetstormsecurity.com/files/157857/QNAP-QTS-And-Photo-Station-6.0.3-Remote-Command-Execution.html

Source: security@qnapsecurity.com.tw · Exploit, Third Party Advisory, VDB Entry

https://www.qnap.com/zh-tw/security-advisory/nas-201911-25

Source: security@qnapsecurity.com.tw · Vendor Advisory

http://packetstormsecurity.com/files/157857/QNAP-QTS-And-Photo-Station-6.0.3-Remote-Command-Execution.html

Source: af854a3a-2127-422b-91ae-364da2661108 · Exploit, Third Party Advisory, VDB Entry

https://www.qnap.com/zh-tw/security-advisory/nas-201911-25

Source: af854a3a-2127-422b-91ae-364da2661108 · Vendor Advisory

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-7193

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 · US Government Resource

Frequently Asked SecOps Questions (CVE-2019-7193)

FAQ

Q1. How critical is CVE-2019-7193 and is it actively exploited in the wild?

CVE-2019-7193 is rated CVSS 9.8 (CRITICAL) with a 30-day EPSS exploitation probability of 14.4%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.

Q2. Which vendors and products are affected by CVE-2019-7193?

Primary impacted vendors include qnap across qts, photo station. Scope summary: QNAP QTS and Photo Station versions 6.0.3 and prior

Q3. What temporary mitigations or workarounds exist for CVE-2019-7193 before patching?

[Mitigation] Immediately update QTS and Photo Station to the latest patched versions recommended by QNAP Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.

SECOPS WORKBENCH INTEGRATION