CVE-2019-7192

What is QNAP Photo Station?

Photo Station is a photo gallery and management application bundled with QNAP's QTS operating system for its network-attached storage (NAS) appliances. It lets users browse, share, and organize photos stored on the NAS, often through public sharing links exposed directly to the internet — making it a frequently internet-facing service on small business and consumer NAS deployments.

Overview

CVE-2019-7192 is an improper access control vulnerability (CWE-863) in Photo Station that lets a remote, unauthenticated attacker gain access to protected resources on the NAS. It carries a maximum-severity CVSS score of 9.8 and was disclosed and patched together with three related QNAP flaws — CVE-2019-7193, CVE-2019-7194, and CVE-2019-7195 — affecting QTS and Photo Station in the same December 2019 update. CISA added it to the KEV catalog in June 2022, flagging confirmed ransomware use.

Technical Details

The flaw stems from Photo Station's access-control checks failing to properly verify a requesting user's authorization before granting access to internal functions or data — a classic CWE-863 (incorrect authorization) issue. Because Photo Station instances are commonly exposed to the internet for photo-sharing convenience, and the flaw requires no authentication or user interaction, it gives attackers a low-effort entry point into the NAS's file system and configuration.

Discovery

This vulnerability was reported to QNAP through the vendor's standard security-advisory process and patched via a QTS/Photo Station firmware update; NVD does not credit an individual external researcher.

Exploitation Context

QNAP NAS devices have been a persistent target for ransomware and credential-theft campaigns, including the eCh0raix (QNAPCrypt) ransomware family and the QSnatch data-stealing malware that CISA and international CERT partners jointly warned about. CISA's KEV entry marks this CVE for confirmed ransomware-campaign use, and its disclosure alongside the other three Photo Station/QTS flaws from the same patch batch is consistent with attackers chaining them together for full device takeover.

Remediation

1. Update QTS and the Photo Station application to the latest vendor-supported versions immediately.
2. Disable or remove Photo Station if it is not actively needed, especially on internet-facing NAS units.
3. Never expose NAS administration or Photo Station interfaces directly to the internet — place them behind a VPN or firewall.
4. Enable QNAP's built-in Malware Remover and IP access controls, and review NAS logs for unauthorized access.
5. Keep automatic firmware updates enabled to receive future QNAP security patches promptly.