CVE-2019-7193: QNAP QTS Improper Input Validation Vulnerability

Published Dec 5, 2019

Updated

This improper input validation vulnerability allows remote attackers to inject arbitrary code to the system. To fix the vulnerability, QNAP recommend updating QTS to their latest versions.

Other sources

QNAP QTS contains an improper input validation vulnerability allowing remote attackers to inject code on the system.

— CISA

Affected Software

26 affected components

QNAP QTS=4.3.6.0895

QNAP QTS=4.3.6.0907

QNAP QTS=4.3.6.0923

QNAP QTS=4.3.6.0944

QNAP QTS=4.3.6.0959

QNAP QTS=4.3.6.0979

QNAP QTS=4.3.6.0993

QNAP QTS=4.3.6.1013

QNAP QTS=4.3.6.1033

QNAP QTS=4.4.1.0948-beta

QNAP QTS=4.4.1.0949-beta

QNAP QTS=4.4.1.0978-beta_2

QNAP QTS=4.4.1.0998-beta_3

QNAP QTS=4.4.1.0999-beta_3

QNAP QTS=4.4.1.1031-beta_4

QNAP QTS=4.4.1.1033-beta_4

QNAP QTS

QNAP QTS=4.3.6.0895

QNAP QTS=4.3.6.0907

QNAP QTS=4.3.6.0923

QNAP QTS=4.3.6.0944

QNAP QTS=4.3.6.0959

QNAP QTS=4.3.6.0979

QNAP QTS=4.3.6.0993

QNAP QTS=4.3.6.1013

QNAP QTS=4.3.6.1033

Event History

Dec 5, 2019

CVE Published

via MITRE·04:22 PM

Data Sourced

via MITRE·04:22 PM

DescriptionWeakness

Data Sourced

via NVD·05:15 PM

DescriptionSeverityWeaknessAffected Software

Jun 8, 2022

Known Exploited

via CISA·12:00 AM

Known Ransomware

via CISA·12:00 AM

Frequently Asked Questions

What is CVE-2019-7193?

CVE-2019-7193 is an improper input validation vulnerability in QNAP QTS.

How can remote attackers exploit CVE-2019-7193?

Remote attackers can exploit CVE-2019-7193 to inject arbitrary code to the system.

What is the severity of CVE-2019-7193?

CVE-2019-7193 has a severity level of 9.8 (critical).

How can I fix CVE-2019-7193?

To fix CVE-2019-7193, QNAP recommends updating QTS to the latest version.

Where can I find more information about CVE-2019-7193?

You can find more information about CVE-2019-7193 in the references provided: http://packetstormsecurity.com/files/157857/QNAP-QTS-And-Photo-Station-6.0.3-Remote-Command-Execution.html, https://www.qnap.com/zh-tw/security-advisory/nas-201911-25