KEVIntel
Back to KEVs
9.8
CVSS
Critical

CVE-2019-7194

PUBLISHED

This external control of file name or path vulnerability allows remote attackers to access or modify system files. To fix the vulnerability, QNAP...

Exploited in the wild Used in malware Remote Low complexity No user interaction
Vendor
QNAP
Product
QNAP NAS devices running Photo Station
Published
Dec 05, 2019
EPSS
—

Description

This external control of file name or path vulnerability allows remote attackers to access or modify system files. To fix the vulnerability, QNAP recommend updating Photo Station to their latest versions.

cisa malware ransomware nuclei_scanner

CVSS scores

CVSS v3.1 9.8 Critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS v2.0 7.5

AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitation status

Exploited in the wild

Recorded 2022-06-08 00:00:00 UTC · Source

Used in malware

Recorded 2022-06-08 00:00:00 UTC · Source

SSVC decision points

Exploitation
active
Automatable
Yes
Technical impact
total

References

Known exploited vulnerability sources

Catalogues that list this CVE as a known exploited vulnerability.

Source Added
CISA Jun 08, 2022

Scanner integrations

Scanner Reference Detected
Nuclei https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-7194.yaml Jun 01, 2026

Timeline

  • CVE ID Reserved

  • CVE Published to Public

  • Exploit Used in Malware

  • Added to KEVIntel

  • Detected by Nuclei