CVE-2019-7192

CVE-2019-7192 is a critical improper access control flaw (CWE-863) in QNAP Photo Station, the web-based photo application that runs on QNAP QTS NAS devices. Because the flaw is reachable over the network without credentials or user interaction (CVSS 3.1 9.8), remote attackers can gain unauthorized access to vulnerable systems. A public proof of concept demonstrates chaining the bug into remote command execution on Photo Station 6.0.3 under QTS, giving attackers the ability to execute commands on the NAS. Any QNAP NAS running an outdated Photo Station, particularly when its web interface is exposed to untrusted networks, is affected. Exploitation is confirmed in the wild: CISA added it to the KEV on 2022-06-08 with known ransomware use, and EPSS assigns a 88.2% probability of exploitation in the next 30 days (top percentile).

What to do: Update Photo Station to the latest version per QNAP's security advisory, and verify the installed Photo Station version on every QTS NAS. Where updating is not immediately possible, disable Photo Station or restrict its web endpoints to trusted networks, and check devices for signs of compromise given the known ransomware exploitation.