9.8
Critical
CVE-2019-7193 QNAP QTS Improper Input Validation Vulnerability
Active exploitation observed
· CISA KEV catalogue
Required action
Apply updates per vendor instructions.
Ransomware campaigns
Known to be used
Weakness
CWE-20
Description
This improper input validation vulnerability allows remote attackers to inject arbitrary code to the system. To fix the vulnerability, QNAP recommend updating QTS to their latest versions.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| QNAP NAS devices | Versions not published |
Other CVEs of QNAP NAS devices
The 6 CVEs of QNAP NAS devices →
CVE-2019-7183
This improper link resolution vulnerability allows remote attackers to access system files
Not rated
CVE-2019-7197
A stored cross-site scripting (XSS) vulnerability has been reported to affect multiple versions of QTS
Not rated
CVE-2018-0730
This command injection vulnerability in File Station allows attackers to execute commands on the affected device
Not rated
CVE-2018-0729
This command injection vulnerability in Music Station allows attackers to execute commands on the affected device
Not rated