CVE-2019-7195KEV · OVERDUE

QNAP Photo Station Path Traversal Vulnerability

Critical · published December 5, 2019

Patch now

Confirmed exploited, and the score agrees

CVSS calls it critical at 9.8. It is confirmed in active exploitation. It sits in the 99.8th percentile for exploit probability.

1584
days past CISA
deadline
CVSS v3.1
9.8
EPSS
90%
Percentile
99.8
In the wild
Confirmed
What it is

🚨 An external control of file name vulnerability means attackers can slip into your system and mess with files – yikes! 🔥 It's like a restaurant that lets just anyone in the kitchen, where they can swap ingredients or even change the recipe without anyone noticing! Imagine the chaos if a rogue chef decided to turn your soufflé into a soufflé surprise! An uninvited guest could waltz into your system, accessing or modifying critical files with ease. This could lead to data breaches, loss of integrity, or even complete control over your system – absolutely devastating!

Put simply

It's like a restaurant that lets just anyone in the kitchen, where they can swap ingredients or even change the recipe without anyone noticing! Imagine the chaos if a rogue chef decided to turn your soufflé into a soufflé surprise! This vulnerability allows remote attackers to control the file paths, enabling them to read or alter system files without any authentication checks.

What to do

An uninvited guest could waltz into your system, accessing or modifying critical files with ease. This could lead to data breaches, loss of integrity, or even complete control over your system – absolutely devastating! Update your QNAP Photo Station to the latest version immediately to patch this vulnerability. Don't leave your system exposed – take action now! You've got this! Follow these steps, and you’ll lock down your system in no time! 🛡️

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.89681 · 99.8th percentile
Published
2019-12-05T16:34Z
KEV added
2022-06-08 · due 2022-06-22
EPSS history
Timeline
  • 08 JUN 00:00Z
    Added to CISA KEV — remediate by Jun 22
    kev
  • 05 DEC 16:34Z
    This external control of file name or path vulnerability allows remote attackers to access or modify system files
    cvelistv5