CVE-2019-7192

As of 2025-10-27, CVE-2019-7192 is a CVSS 9.8 (CRITICAL-severity) vulnerability. CISA KEV-listed (known exploited). EPSS exploitation probability 94.3%. Threadlinqs Intelligence tracks 1 threat exploiting it.

Last updated: 2025-10-27

This improper access control vulnerability allows remote attackers to gain unauthorized access to the system. To fix these vulnerabilities, QNAP recommend updating Photo Station to their latest versions.

CVSS v3 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

CWE-863

Exploitation status

CISA KEV-listed (known exploited)

Threats tracking this CVE

• AI-Augmented FortiGate Mass Exploitation — Russian-Speaking Actor Breaches 600+ Firewalls Across 55 Countries Using LLM-Generated Tooling and Custom MCP Framework — CRITICAL

References

• http://packetstormsecurity.com/files/157857/QNAP-QTS-And-Photo-Station-6.0.3-Remote-Command-Execution.html
• https://www.qnap.com/zh-tw/security-advisory/nas-201911-25
• http://packetstormsecurity.com/files/157857/QNAP-QTS-And-Photo-Station-6.0.3-Remote-Command-Execution.html
• https://www.qnap.com/zh-tw/security-advisory/nas-201911-25
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-7192

← all vulnerabilities · Markdown version · Threadlinqs Intelligence

Enriched from CVE.org, NVD (this product uses the NVD API but is not endorsed or certified by the NVD), FIRST EPSS, CISA KEV, and GitHub Security Advisories.