CVE-2019-7194

What is QNAP Photo Station?

Photo Station is a photo gallery and management application bundled with QNAP's QTS operating system for its network-attached storage (NAS) appliances. It is commonly exposed to the internet for photo-sharing convenience, making it a frequent target for automated scanning and compromise.

Overview

CVE-2019-7194 is a path traversal vulnerability (CWE-22, "external control of file name or path") in Photo Station allowing a remote, unauthenticated attacker to read or modify files outside the intended directory. It is rated critical (CVSS 9.8) and was patched in the same December 2019 update that fixed the related flaws CVE-2019-7192, CVE-2019-7193, and CVE-2019-7195.

Technical Details

Photo Station accepts attacker-influenced values (such as file or path parameters) without adequately sanitizing directory-traversal sequences (e.g., ../), letting a request escape the intended photo-storage directory and reach arbitrary locations on the NAS filesystem. Depending on the specific code path, this can expose configuration files or credentials, or allow planting of files that are later executed.

Discovery

Disclosed through QNAP's vendor advisory process; fixed in the QTS/Photo Station updates released in December 2019.

Exploitation Context

As with the related Photo Station/QTS CVEs from this batch, CISA's KEV entry confirms real-world exploitation, with ransomware operators targeting internet-exposed QNAP NAS devices (eCh0raix/QNAPCrypt) known to chain these path-traversal and access-control flaws for full compromise.

Remediation

1. Update QTS and Photo Station to the latest patched versions.
2. Take Photo Station offline or restrict it to LAN-only access if it isn't actively required.
3. Block inbound internet access to NAS management and photo-sharing ports at the firewall/router.
4. Scan the device with QNAP's Malware Remover and check for unexpected files or scheduled tasks.
5. Rotate any credentials stored on or accessible from the NAS if compromise is suspected.