What’s Vulnerable › Vulnerabilities

CVE-2019-7193: QNAP QTS Improper Input Validation Vulnerability

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: yes — in CISA KEV since 2022-06-08
• EPSS: 14.4% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2019-12-05 · updated 2026-06-17
• Weakness: CWE-20

Description

This improper input validation vulnerability allows remote attackers to inject arbitrary code to the system. To fix the vulnerability, QNAP recommend updating QTS to their latest versions.

Affected products

• QNAP QTS: 4.3.6.0895, 4.3.6.0907, 4.3.6.0923, 4.3.6.0944, 4.3.6.0959, 4.3.6.0979 (+10)

References

• http://packetstormsecurity.com/files/157857/QNAP-QTS-And-Photo-Station-6.0.3-Remote-Command-Execution.html
• https://www.qnap.com/zh-tw/security-advisory/nas-201911-25
• http://packetstormsecurity.com/files/157857/QNAP-QTS-And-Photo-Station-6.0.3-Remote-Command-Execution.html
• https://www.qnap.com/zh-tw/security-advisory/nas-201911-25
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-7193

Get alerted when CVE-2019-7193 or the next vulnerability affects your stack