{"cve_id":"CVE-2019-7194","title":"QNAP Photo Station < 6.0.3 - Remote Code Execution","severity":"critical","actively_exploited":true,"patterns":["/cgi-bin/userConfig.cgi","/photo/slideshow.php","/photo/p/api/album.php","/cgi-bin/authLogin.cgi","/photo/p/api/video.php"],"events":3646,"unique_ips":290,"actors":[{"ip":"185.125.201.79","events":108,"country_code":"RU","country":"Russia","org":"Timeweb, LLP","rdns":"","scanner_tag":null},{"ip":"137.184.31.121","events":70,"country_code":"US","country":"United States","org":"DigitalOcean, LLC","rdns":"","scanner_tag":null},{"ip":"147.182.213.43","events":61,"country_code":"US","country":"United States","org":"DigitalOcean, LLC","rdns":"","scanner_tag":null},{"ip":"206.189.193.127","events":46,"country_code":"US","country":"United States","org":"DigitalOcean, LLC","rdns":"","scanner_tag":null},{"ip":"143.198.164.235","events":43,"country_code":"US","country":"United States","org":"DigitalOcean, LLC","rdns":"scale-test-1779871031033-b7767c5f.mongo.ondigitalocean.com","scanner_tag":{"key":"digitalocean","label":"DigitalOcean","category":"hosting_provider","url":"https://www.digitalocean.com/"}},{"ip":"167.99.224.66","events":42,"country_code":"US","country":"United States","org":"DigitalOcean, LLC","rdns":"","scanner_tag":null},{"ip":"146.190.70.246","events":41,"country_code":"US","country":"United States","org":"DigitalOcean, LLC","rdns":"","scanner_tag":null},{"ip":"167.71.31.227","events":41,"country_code":"US","country":"United States","org":"DigitalOcean, LLC","rdns":"","scanner_tag":null},{"ip":"159.89.236.29","events":40,"country_code":"US","country":"United States","org":"DigitalOcean, LLC","rdns":"","scanner_tag":null},{"ip":"134.122.21.36","events":40,"country_code":"US","country":"United States","org":"DigitalOcean, LLC","rdns":"","scanner_tag":null},{"ip":"147.182.178.36","events":40,"country_code":"US","country":"United States","org":"DigitalOcean, LLC","rdns":"","scanner_tag":null},{"ip":"68.183.122.21","events":40,"country_code":"US","country":"United States","org":"DigitalOcean, LLC","rdns":"","scanner_tag":null},{"ip":"198.199.89.181","events":39,"country_code":"US","country":"United States","org":"DigitalOcean, LLC","rdns":"","scanner_tag":null},{"ip":"198.199.121.134","events":39,"country_code":"US","country":"United States","org":"DigitalOcean, LLC","rdns":"","scanner_tag":null},{"ip":"147.182.185.175","events":39,"country_code":"US","country":"United States","org":"DigitalOcean, LLC","rdns":"","scanner_tag":null},{"ip":"167.99.151.225","events":39,"country_code":"US","country":"United States","org":"DigitalOcean, LLC","rdns":"","scanner_tag":null},{"ip":"206.189.230.61","events":39,"country_code":"US","country":"United States","org":"DigitalOcean, LLC","rdns":"","scanner_tag":null},{"ip":"104.248.48.34","events":38,"country_code":"US","country":"United States","org":"DigitalOcean, LLC","rdns":"","scanner_tag":null},{"ip":"24.199.82.210","events":38,"country_code":"US","country":"United States","org":"DigitalOcean, LLC","rdns":"","scanner_tag":null},{"ip":"165.227.196.13","events":37,"country_code":"US","country":"United States","org":"DigitalOcean, LLC","rdns":"","scanner_tag":null},{"ip":"157.230.187.192","events":37,"country_code":"US","country":"United States","org":"DigitalOcean, LLC","rdns":"","scanner_tag":null},{"ip":"142.93.194.134","events":37,"country_code":"US","country":"United States","org":"DigitalOcean, LLC","rdns":"","scanner_tag":null},{"ip":"161.35.5.183","events":36,"country_code":"US","country":"United States","org":"DigitalOcean, LLC","rdns":"","scanner_tag":null},{"ip":"165.227.200.41","events":36,"country_code":"US","country":"United States","org":"DigitalOcean, LLC","rdns":"","scanner_tag":null},{"ip":"157.245.247.139","events":36,"country_code":"US","country":"United States","org":"DigitalOcean, LLC","rdns":"","scanner_tag":null},{"ip":"143.198.165.117","events":35,"country_code":"US","country":"United States","org":"DigitalOcean, LLC","rdns":"","scanner_tag":null},{"ip":"134.122.112.94","events":35,"country_code":"US","country":"United States","org":"DigitalOcean, LLC","rdns":"","scanner_tag":null},{"ip":"204.48.19.79","events":34,"country_code":"US","country":"United States","org":"DigitalOcean, LLC","rdns":"","scanner_tag":null},{"ip":"198.211.110.41","events":34,"country_code":"US","country":"United States","org":"DigitalOcean, LLC","rdns":"","scanner_tag":null},{"ip":"159.223.165.107","events":34,"country_code":"US","country":"United States","org":"DigitalOcean, LLC","rdns":"","scanner_tag":null},{"ip":"198.211.106.32","events":34,"country_code":"US","country":"United States","org":"DigitalOcean, LLC","rdns":"","scanner_tag":null},{"ip":"146.190.209.46","events":34,"country_code":"US","country":"United States","org":"DigitalOcean, LLC","rdns":"","scanner_tag":null},{"ip":"167.99.229.116","events":34,"country_code":"US","country":"United States","org":"DigitalOcean, LLC","rdns":"","scanner_tag":null},{"ip":"198.211.107.181","events":33,"country_code":"US","country":"United States","org":"DigitalOcean, LLC","rdns":"","scanner_tag":null},{"ip":"167.99.234.27","events":33,"country_code":"US","country":"United States","org":"DigitalOcean, LLC","rdns":"","scanner_tag":null},{"ip":"162.243.175.232","events":33,"country_code":"US","country":"United States","org":"DigitalOcean, LLC","rdns":"","scanner_tag":null},{"ip":"143.198.163.156","events":33,"country_code":"US","country":"United States","org":"DigitalOcean, LLC","rdns":"","scanner_tag":null},{"ip":"64.227.21.125","events":33,"country_code":"US","country":"United States","org":"DigitalOcean, LLC","rdns":"tournament.commemorate.dependence.co.nz","scanner_tag":null},{"ip":"157.230.10.16","events":33,"country_code":"US","country":"United States","org":"DigitalOcean, LLC","rdns":"","scanner_tag":null},{"ip":"167.172.158.249","events":32,"country_code":"US","country":"United States","org":"DigitalOcean, LLC","rdns":"","scanner_tag":null},{"ip":"157.230.234.157","events":32,"country_code":"US","country":"United States","org":"DigitalOcean, LLC","rdns":"","scanner_tag":null},{"ip":"159.89.51.95","events":31,"country_code":"US","country":"United States","org":"DigitalOcean, LLC","rdns":"","scanner_tag":null},{"ip":"67.205.131.16","events":31,"country_code":"US","country":"United States","org":"DigitalOcean, LLC","rdns":"","scanner_tag":null},{"ip":"161.35.113.47","events":31,"country_code":"US","country":"United States","org":"DigitalOcean, LLC","rdns":"","scanner_tag":null},{"ip":"206.189.197.33","events":31,"country_code":"US","country":"United States","org":"DigitalOcean, LLC","rdns":"","scanner_tag":null},{"ip":"206.189.229.60","events":31,"country_code":"US","country":"United States","org":"DigitalOcean, LLC","rdns":"","scanner_tag":null},{"ip":"192.241.143.35","events":31,"country_code":"US","country":"United States","org":"DigitalOcean, LLC","rdns":"","scanner_tag":null},{"ip":"146.190.64.87","events":30,"country_code":"US","country":"United States","org":"DigitalOcean, LLC","rdns":"","scanner_tag":null},{"ip":"68.183.111.245","events":30,"country_code":"US","country":"United States","org":"DigitalOcean, LLC","rdns":"","scanner_tag":null},{"ip":"67.205.184.226","events":30,"country_code":"US","country":"United States","org":"DigitalOcean, LLC","rdns":"","scanner_tag":null}],"top_asns":[{"asn":14061,"org":"DigitalOcean, LLC","events":3298,"ips":199},{"asn":211680,"org":"Sistemas Informaticos, S.A.","events":143,"ips":56},{"asn":210976,"org":"Timeweb, LLP","events":108,"ips":1},{"asn":21859,"org":"Zenlayer Inc","events":53,"ips":28},{"asn":135377,"org":"UCLOUD INFORMATION TECHNOLOGY HK LIMITED","events":5,"ips":1},{"asn":51396,"org":"Pfcloud UG (haftungsbeschrankt)","events":1,"ips":1}],"fingerprints":{"ja4h":["ge11nn0300_86b6b04cb9cc","ge11nn0400_88d30a62b7ad","po11nn0600_5aaf82b7b36c","ge11nn15en_a743836884df","ge11nn0300_0db47b7d240d","po11nn0500_b4ba55311b46"],"ja4":["t13i190800_9dc949149365_97f8aa674fd9","t12i330500_5172cef6ed69_021165082e1c","t13i250900_b78ed14e2fd0_e7c285222651"]},"sample_paths":["/cgi-bin/authLogin.cgi","/photo/slideshow.php?album=","/photo/p/api/album.php","/photo/p/api/video.php"],"timeline":[{"day":"2026-04-29","events":7,"ips":5},{"day":"2026-04-30","events":4,"ips":3},{"day":"2026-05-01","events":1,"ips":1},{"day":"2026-05-04","events":5,"ips":4},{"day":"2026-05-05","events":7,"ips":6},{"day":"2026-05-06","events":15,"ips":6},{"day":"2026-05-07","events":24,"ips":5},{"day":"2026-05-08","events":62,"ips":8},{"day":"2026-05-09","events":57,"ips":14},{"day":"2026-05-10","events":72,"ips":17},{"day":"2026-05-11","events":81,"ips":25},{"day":"2026-05-12","events":96,"ips":26},{"day":"2026-05-13","events":63,"ips":10},{"day":"2026-05-14","events":38,"ips":13},{"day":"2026-05-15","events":97,"ips":17},{"day":"2026-05-16","events":50,"ips":13},{"day":"2026-05-17","events":29,"ips":7},{"day":"2026-05-18","events":35,"ips":7},{"day":"2026-05-19","events":55,"ips":19},{"day":"2026-05-20","events":45,"ips":15},{"day":"2026-05-21","events":64,"ips":15},{"day":"2026-05-22","events":43,"ips":13},{"day":"2026-05-23","events":44,"ips":11},{"day":"2026-05-24","events":29,"ips":3},{"day":"2026-05-25","events":60,"ips":12},{"day":"2026-05-26","events":51,"ips":15},{"day":"2026-05-27","events":51,"ips":18},{"day":"2026-05-28","events":48,"ips":7},{"day":"2026-05-29","events":26,"ips":8},{"day":"2026-05-30","events":63,"ips":5},{"day":"2026-05-31","events":42,"ips":5},{"day":"2026-06-01","events":51,"ips":8},{"day":"2026-06-02","events":55,"ips":18},{"day":"2026-06-03","events":75,"ips":19},{"day":"2026-06-04","events":75,"ips":18},{"day":"2026-06-05","events":47,"ips":3},{"day":"2026-06-06","events":24,"ips":10},{"day":"2026-06-07","events":47,"ips":11},{"day":"2026-06-08","events":48,"ips":16},{"day":"2026-06-09","events":38,"ips":9},{"day":"2026-06-10","events":36,"ips":3},{"day":"2026-06-11","events":24,"ips":9},{"day":"2026-06-12","events":42,"ips":4},{"day":"2026-06-13","events":43,"ips":9},{"day":"2026-06-14","events":46,"ips":8},{"day":"2026-06-15","events":42,"ips":15},{"day":"2026-06-16","events":62,"ips":19},{"day":"2026-06-17","events":79,"ips":11},{"day":"2026-06-18","events":94,"ips":6},{"day":"2026-06-19","events":33,"ips":6},{"day":"2026-06-20","events":106,"ips":18},{"day":"2026-06-21","events":45,"ips":17},{"day":"2026-06-22","events":52,"ips":14},{"day":"2026-06-23","events":43,"ips":6},{"day":"2026-06-24","events":29,"ips":11},{"day":"2026-06-25","events":50,"ips":9},{"day":"2026-06-26","events":37,"ips":5},{"day":"2026-06-27","events":34,"ips":15},{"day":"2026-06-28","events":16,"ips":11},{"day":"2026-06-29","events":36,"ips":14},{"day":"2026-06-30","events":42,"ips":5},{"day":"2026-07-01","events":4,"ips":3},{"day":"2026-07-02","events":9,"ips":7},{"day":"2026-07-03","events":24,"ips":13},{"day":"2026-07-04","events":12,"ips":9},{"day":"2026-07-05","events":6,"ips":6},{"day":"2026-07-06","events":3,"ips":2},{"day":"2026-07-07","events":3,"ips":3},{"day":"2026-07-08","events":5,"ips":4},{"day":"2026-07-09","events":7,"ips":6},{"day":"2026-07-10","events":12,"ips":7},{"day":"2026-07-11","events":11,"ips":7},{"day":"2026-07-12","events":4,"ips":4},{"day":"2026-07-13","events":26,"ips":4},{"day":"2026-07-14","events":49,"ips":15},{"day":"2026-07-15","events":39,"ips":19},{"day":"2026-07-16","events":55,"ips":17},{"day":"2026-07-17","events":54,"ips":18},{"day":"2026-07-18","events":50,"ips":6},{"day":"2026-07-19","events":28,"ips":10},{"day":"2026-07-20","events":58,"ips":20},{"day":"2026-07-21","events":70,"ips":22},{"day":"2026-07-22","events":44,"ips":14},{"day":"2026-07-23","events":65,"ips":15},{"day":"2026-07-24","events":46,"ips":6},{"day":"2026-07-25","events":31,"ips":14},{"day":"2026-07-26","events":56,"ips":15},{"day":"2026-07-27","events":59,"ips":12},{"day":"2026-07-28","events":1,"ips":1}],"window_hours":2160}