CVE-2019-7193 - This improper input validation vulnerability allows remote attackers to inject arbitrary code to the system

Back Back to CVE browser

CRITICAL KEV

This improper input validation vulnerability allows remote attackers to inject arbitrary code to the system

Published Dec 5, 2019 ·Due Jun 22, 2022

9.8

CRITICAL

CVSS 3.1

EPSS 14.37%

Description

This improper input validation vulnerability allows remote attackers to inject arbitrary code to the system. To fix the vulnerability, QNAP recommend updating QTS to their latest versions.

Affected products

Vendor n/a Product QNAP NAS devices Default
n/a
- Version
  QTS 4.4.0 - QTS 4.4.1: before build 20190918, QTS 4.3.6: before build 20190919
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

n/a

QNAP NAS devices

n/a

Version	Status	Constraints
QTS 4.4.0 - QTS 4.4.1: before build 20190918, QTS 4.3.6: before build 20190919	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-20

Improper Input Validation

References (3)

http://packetstormsecurity.com/files/157857/QNAP-QTS-And-Photo-Station-6.0.3-Remote-Command-Execution.html
x_refsource_MISCExploitThird Party AdvisoryVDB Entry
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-7193
government-resourceUS Government Resource
https://www.qnap.com/zh-tw/security-advisory/nas-201911-25
x_refsource_CONFIRMVendor Advisory

Link	Providers	Tags
http://packetstormsecurity.com/files/157857/QNAP-QTS-And-Photo-Station-6.0.3-Remote-Command-Execution.html		x_refsource_MISCExploitThird Party AdvisoryVDB Entry
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-7193		government-resourceUS Government Resource
https://www.qnap.com/zh-tw/security-advisory/nas-201911-25		x_refsource_CONFIRMVendor Advisory