CVE-2019-7193

CRITICAL CISA KEV

This improper input validation vulnerability allows remote attackers to inject arbitrary code to the system. To fix the vulnerability, QNAP recommend updating QTS to their latest versions.

Published: Dec 5, 2019 Modified: Jun 17, 2026

NVD-CWE-noinfo CWE-20

CVSS Metrics

CVSSv3

Attack Vector: NETWORK Attack Complexity: LOW Privileges Required: NONE User Interaction: NONE Scope: UNCHANGED Confidentiality Impact: HIGH Integrity Impact: HIGH Availability Impact: HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected Products (16)

Vendor	Product	Version
qnap	qts	4.3.6.0895
qnap	qts	4.3.6.0907
qnap	qts	4.3.6.0923
qnap	qts	4.3.6.0944
qnap	qts	4.3.6.0959
qnap	qts	4.3.6.0979
qnap	qts	4.3.6.0993
qnap	qts	4.3.6.1013
qnap	qts	4.3.6.1033
qnap	qts	4.4.1.0948
qnap	qts	4.4.1.0949
qnap	qts	4.4.1.0978
qnap	qts	4.4.1.0998
qnap	qts	4.4.1.0999
qnap	qts	4.4.1.1031
qnap	qts	4.4.1.1033

GitHub Security Advisory GHSA-964w-hfj4-c2g7

This improper input validation vulnerability allows remote attackers to inject arbitrary code to...

References (5)

http://packetstormsecurity.com/files/157857/QNAP-QTS-And-Photo-Station-6.0.3-Remote-Command-Execution.html Exploit, Third Party Advisory, VDB Entry
https://www.qnap.com/zh-tw/security-advisory/nas-201911-25 Vendor Advisory
http://packetstormsecurity.com/files/157857/QNAP-QTS-And-Photo-Station-6.0.3-Remote-Command-Execution.html Exploit, Third Party Advisory, VDB Entry
https://www.qnap.com/zh-tw/security-advisory/nas-201911-25 Vendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-7193 US Government Resource

Risk Scores

CVSS Score 9.8 / 10

EPSS Score 14.37%

Top 4% most likely to be exploited

Threat Score 73.5 / 100

CISA Known Exploited

Date Added: 2022-06-08

Due Date: 2022-06-22

Required Action:

Apply updates per vendor instructions.

Used in Ransomware Campaigns

Data Sources

NVD CISA KEV EPSS GitHub