CVE-2019-7193

CriticalCVSS 9.8/10Known exploited (CISA KEV)Last modified Jun 17, 2026

Description

This improper input validation vulnerability allows remote attackers to inject arbitrary code to the system. To fix the vulnerability, QNAP recommend updating QTS to their latest versions.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-20

Affected software

Vendor	Product	Versions
n/a	QNAP NAS devices	QTS 4.4.0 - QTS 4.4.1: before build 20190918, QTS 4.3.6: before build 20190919

References

http://packetstormsecurity.com/files/157857/QNAP-QTS-And-Photo-Station-6.0.3-Remote-Command-Execution.htmlExploit, Third Party Advisory, VDB Entry
https://www.qnap.com/zh-tw/security-advisory/nas-201911-25Vendor Advisory
http://packetstormsecurity.com/files/157857/QNAP-QTS-And-Photo-Station-6.0.3-Remote-Command-Execution.htmlExploit, Third Party Advisory, VDB Entry
https://www.qnap.com/zh-tw/security-advisory/nas-201911-25Vendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-7193US Government Resource

Timeline

Published: Dec 5, 2019
Last modified: Jun 17, 2026
Added to CISA KEV: Jun 8, 2022
NVD status: Analyzed

Related CVEs from 2019

CVE-2019-71949.8This external control of file name or path vulnerability allows remote attackers to access or modify system files. To fix the vulnerability,CVE-2019-71959.8This external control of file name or path vulnerability allows remote attackers to access or modify system files. To fix the vulnerability,CVE-2019-71974.8A stored cross-site scripting (XSS) vulnerability has been reported to affect multiple versions of QTS. If exploited, this vulnerability may CVE-2019-71989.8This command injection vulnerability allows attackers to execute arbitrary commands in a compromised application. QNAP have already fixed th CVE-2019-72017.8An unquoted service path vulnerability is reported to affect the service QVssService in QNAP NetBak Replicator. This vulnerability could all CVE-2019-72116.1SmarterTools SmarterMail 16.x before build 6995 has stored XSS. JavaScript code could be executed on the application by opening a malicious CVE-2019-72128.2SmarterTools SmarterMail 16.x before build 6985 has hardcoded secret keys. An unauthenticated attacker could access other users’ emails and CVE-2019-72136.5SmarterTools SmarterMail 16.x before build 6985 allows directory traversal. An authenticated user could delete arbitrary files or could crea CVE-2019-72149.8SmarterTools SmarterMail 16.x before build 6985 allows deserialization of untrusted data. An unauthenticated attacker could run commands on CVE-2019-72156.5Progress Sitefinity 10.1.6536 does not invalidate session cookies upon logouts. It instead tries to overwrite the cookie in the browser, but CVE-2019-72167.8An issue was discovered in FileChucker 4.99e-free-e02. filechucker.cgi has a filter bypass that allows a malicious user to upload any type o CVE-2019-72177.5Citrix ShareFile before 19.12 allows User Enumeration. It is possible to enumerate application username based on different server responses