Exploited vulnerability · CISA KEV

Is CVE-2019-7195 exploited? Yes: in CISA KEV since 8 Jun 2022

Gociux · QNAP Photo Station · data: CISA KEV, CVE record, FIRST EPSS

Yes. CVE-2019-7195, QNAP Photo Station Path Traversal Vulnerability, is being exploited in the wild. CISA added it to its Known Exploited Vulnerabilities catalog on 8 Jun 2022, 916 days after it was published. It is known to be used in ransomware campaigns. It affects QNAP Photo Station. If you run it, CISA's required action is: Apply updates per vendor instructions.

exploitedYesCISA KEV · 8 Jun 2022

ransomwareKnownused in campaigns

EPSStop 1%among the most likely CVEs to be exploited

severity9.8CVSS 3.1 · critical

US federal due22 Jun 2022BOD 22-01 deadline

What it is

QNAP devices running Photo Station contain an external control of file name or path vulnerability allowing remote attackers to access or modify system files.

Vendor	QNAP (11 exploited CVEs in KEV)
Product	Photo Station
Vulnerability	QNAP Photo Station Path Traversal Vulnerability
Weakness	CWE-22
Published	5 Dec 2019
Added to KEV	8 Jun 2022
Reported by (CNA)	qnap

What to do

Check whether you run it. Look for Photo Station in your asset inventory, including appliances and cloud images. Stack check lists every exploited QNAP CVE at once.
Apply the fix. Apply updates per vendor instructions.
If you can't patch today, take the affected service off the internet or restrict who can reach it, and check its logs for signs of compromise since 5 Dec 2019.
Get told next time. Email alerts when CISA adds a CVE for QNAP.

Other exploited CVEs in Photo Station

CVE-2022-27593: QNAP Photo Station Externally Controlled Reference Vulnerability (8 Sep 2022)
CVE-2019-7194: QNAP Photo Station Path Traversal Vulnerability (8 Jun 2022)
CVE-2019-7192: QNAP Photo Station Improper Access Control Vulnerability (8 Jun 2022)

References

nvd.nist.gov/vuln/detail/CVE-2019-7195

Questions

Is CVE-2019-7195 being exploited?

Yes. CISA added CVE-2019-7195 to the Known Exploited Vulnerabilities catalog on 8 Jun 2022, which means there is reliable evidence of exploitation in the wild.

Is CVE-2019-7195 used in ransomware attacks?

Yes, CISA lists it as known to be used in ransomware campaigns.

How do I fix CVE-2019-7195?

Apply updates per vendor instructions. Check QNAP's advisory for the fixed versions, and if you can't patch quickly, restrict access to the affected Photo Station and watch it for signs of compromise.

Sources: CISA KEV (exploitation, ransomware use, required action, due date), the CVE record (publication date, CVSS, CNA), NVD and FIRST EPSS (live score). More: all KEV additions in June 2022 · QNAP scorecard · act-now radar.

Running QNAP in a regulated environment?

We check exposure across your estate, patch or mitigate with your team, and set up detection for what attackers do after exploiting it.

Get in touch →