CVE-2019-7195: Security Advisory for Vulnerabilities in QTS and Photo Station - Security Advisory

<< Back to Security Advisory List

• Release date: November 25, 2019
• Security ID: NAS-201911-25
• Severity: Critical
• CVE identifier: CVE-2019-7192 | CVE-2019-7193 | CVE-2019-7194 | CVE-2019-7195
• Affected products: QNAP NAS devices running Photo Station
• Status: Resolved

Summary

Several vulnerabilities have been reported to affect multiple versions of QTS and Photo Station.

• CVE-2019-7192: This improper access control vulnerability allows remote attackers to gain unauthorized access to the system.
• CVE-2019-7193: This improper input validation vulnerability allows remote attackers to inject arbitrary code to the system.
• CVE-2019-7194: This external control of file name or path vulnerability allows remote attackers to access or modify system files.
• CVE-2019-7195: This external control of file name or path vulnerability allows remote attackers to access or modify system files.

We have already fixed these issues in the following software versions.

QTS:

• QTS 4.4.1: build 20190918 and later
• QTS 4.3.6: build 20190919 and later

Photo Station:

• QTS 4.4.1: Photo Station 6.0.3 and later
• QTS 4.3.4 - QTS 4.4.0: Photo Station 5.7.10 and later
• QTS 4.3.0 - QTS 4.3.3: Photo Station 5.4.9 and later
• QTS 4.2.6: Photo Station 5.2.11 and later

Recommendation

To fix these vulnerabilities, we recommend updating QTS and Photo Station to their latest versions.

Important:

Regardless of which version of QTS you currently use, QNAP strongly recommends updating your QTS to the latest available version for your NAS model to ensure that your device can benefit from vulnerability fixes. You can check the product support status of your NAS model.

Installing the QTS Update

1. Log on to QTS as administrator.
2. Go to Control Panel > System > Firmware Update.
3. Under Live Update, click Check for Update.
   QTS downloads and installs the latest available update.

Tip: You can also download the update from the QNAP website. Go to Support > Download Center and then perform a manual update for your specific device.

Updating Photo Station

1. Log on to QTS as administrator.
2. Open the App Center, and then click .
   A search box appears.
3. Type “Photo Station”, and then press ENTER.
   The Photo Station application appears in the search result list.
4. Click Update.
   A confirmation message appears.
   Note: The Update button is not available if you are using the latest version.
5. Click OK.
   The application is updated.

Acknowledgements: Henry Huang from CyCarrier CSIRT

Revision History: V2.0 (December 5, 2019) - Updated
V1.0 (November 25, 2019) - Published