CVE-2019-7192: QNAP Photo Station improper access control allows unauthenticated remote access

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityCVSS 9.8 unauthenticated remote access control flaw, listed in CISA KEV with known ransomware use and very high EPSS.

What it is

QNAP Photo Station contains an improper access control flaw (CWE-863) that lets remote attackers gain unauthorized access to the system. It is rated CVSS 3.1 9.8 critical and is listed in CISA KEV with known ransomware campaign use, so it is a high-value target for defenders.

Impact

An unauthenticated remote attacker can bypass authorization and gain access to the system, with the potential for full compromise of confidentiality, integrity and availability given the CVSS scope.

Attack surface

Reachable over the network via the Photo Station service with no authentication and no user interaction required, per the CVSS vector AV:N/AC:L/PR:N/UI:N.

Exploitation

CISA KEV lists it as exploited in the wild and associated with known ransomware campaigns, and EPSS is 0.88213 (99.76th percentile); a public exploit reference exists on Packet Storm.

What to do

• Update QNAP Photo Station to the latest version per the vendor security advisory NAS-201911-25.
• If Photo Station is not needed, disable or uninstall it to remove the exposure.
• Restrict network access to Photo Station and QNAP management interfaces to trusted networks or VPN only.
• Monitor QNAP advisories and apply QTS firmware updates that address related issues.
• Verify no unauthorized accounts or persistence were created on affected NAS devices.

Detection

• Review Photo Station and QTS web access logs for anomalous or unauthenticated requests around the time of suspected activity.
• Hunt for unexpected account creation, privilege changes, or new administrative users on QNAP NAS systems.
• Monitor for known exploitation artifacts and post-exploitation behavior tied to ransomware on NAS devices.
• Alert on external access to Photo Station endpoints from untrusted IP addresses.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.