CVE-2019-7192KEV · OVERDUE

QNAP Photo Station Improper Access Control Vulnerability

Critical · published December 5, 2019

Patch now

Confirmed exploited, and the score agrees

CVSS calls it critical at 9.8. It is confirmed in active exploitation. It sits in the 99.8th percentile for exploit probability.

1584
days past CISA
deadline
CVSS v3.1
9.8
EPSS
88%
Percentile
99.8
In the wild
Confirmed
What it is

🚨 A single oversight in access control could let attackers slip right into your QNAP system! 🔥 Think of it like a hotel that forgot to check IDs at the front desk — anyone could just walk in and access the guests' rooms without any verification! In a situation like this, an attacker could gain unauthorized access to sensitive files, potentially leading to data breaches or manipulation of critical system settings. The consequences can be absolutely devastating, as your files and privacy may be at risk.

Put simply

Think of it like a hotel that forgot to check IDs at the front desk — anyone could just walk in and access the guests' rooms without any verification! This vulnerability in QNAP's Photo Station arises from improper access control, allowing remote attackers to bypass security mechanisms and gain system access without the necessary authentication.

What to do

In a situation like this, an attacker could gain unauthorized access to sensitive files, potentially leading to data breaches or manipulation of critical system settings. The consequences can be absolutely devastating, as your files and privacy may be at risk. Update Photo Station to the latest version as recommended by QNAP to close this critical security hole. Don't leave it to chance — ensure all system users are aware of this vulnerability and implement any additional security measures to protect your data. This is fixable! Act quickly, and you’ll secure your system in no time. 🛡️

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.88102 · 99.8th percentile
Published
2019-12-05T16:17Z
KEV added
2022-06-08 · due 2022-06-22
EPSS history
Timeline
  • 08 JUN 00:00Z
    Added to CISA KEV — remediate by Jun 22
    kev
  • 05 DEC 16:17Z
    This improper access control vulnerability allows remote attackers to gain unauthorized access to the system
    cvelistv5