CVE-2019-7194

🗓️ 05 Dec 2019 16:30:53Reported by qnapType

This CVE-2019-7194 vulnerability in QNAP Photo Station allows remote file access or modification. Update to the latest version

Reporter	Title	Published	Views	Family All 29
0daydb	QNAP QTS And Photo Station 6.0.3 - Remote Command Execution	30 May 202014:56	–	0daydb
0day.today	QNAP QTS and Photo Station 6.0.3 - Remote Command Execution Exploit	29 May 202000:00	–	zdt
GithubExploit	Exploit for Incorrect Authorization in Qnap Photo_Station	21 May 202009:14	–	githubexploit
ICS	People’s Republic of China State-Sponsored Cyber Actors Exploit Network Providers and Devices	10 Jun 202212:00	–	ics
ATTACKERKB	CVE-2019-7194	5 Dec 201900:00	–	attackerkb
BDU FSTEC	The vulnerability of the Photo Station photo storage application lies in the improper restriction on the path to the restricted catalog. This allows a violator to compromise the integrity of the data.	7 Sep 202100:00	–	bdu_fstec
Circl	CVE-2019-7194	20 May 202014:15	–	circl
CISA KEV Catalog	QNAP Photo Station Path Traversal Vulnerability	8 Jun 202200:00	–	cisa_kev
CNVD	QNAP Systems Photo Station File Name or Path External Control Vulnerability (CNVD-2020-09620)	6 Dec 201900:00	–	cnvd
Check Point Advisories	QNAP Photo Station Authentication Bypass (CVE-2019-7195; CVE-2019-7194)	8 Jun 202000:00	–	checkpoint_advisories

NVD

Node

qnap photo_stationRange<6.0.3

AND

qnap qtsMatch4.4.1

Node

qnap photo_stationRange<5.7.10

AND

qnap qtsRange4.3.4–4.4.0

Node

qnap photo_stationRange<5.4.9

AND

qnap qtsRange4.3.0–4.3.3

Node

qnap photo_stationRange<5.2.11

AND

qnap qtsMatch4.2.6

[
  {
    "product": "QNAP NAS devices running Photo Station",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "QTS 4.4.1: Photo Station before version 6.0.3, QTS 4.3.4 - QTS 4.4.0: Photo Station before version 5.7.10, QTS 4.3.0 - QTS 4.3.3: Photo Station before version 5.4.9, QTS 4.2.6: Photo Station before version 5.2.11"
      }
    ]
  }
]

Source	Link
packetstormsecurity	www.packetstormsecurity.com/files/157857/QNAP-QTS-And-Photo-Station-6.0.3-Remote-Command-Execution.html
qnap	www.qnap.com/zh-tw/security-advisory/nas-201911-25
cisa	www.cisa.gov/known-exploited-vulnerabilities-catalog

17 Jun 2026 02:40Current

9.3High risk

Vulners AI Score9.3

CVSS 27.5

CVSS 3.19.8

EPSS0.82966

SSVC