Explore

CVEsEarly actors Payloads Campaigns AEI Index Ports User-agents

Integrations

Overview MCP Feeds API / Enrich

Sign in

CVE report

CVE-2019-7194criticalKEV

QNAP Photo Station < 6.0.3 - Remote Code Execution

Events 90d

3,625

Distinct IPs

289

Severity

critical

CISA KEV

Actively exploited

Detection signature

An event counts toward CVE-2019-7194 when its URL path contains any of these (case-insensitive). This is what our matching is based on.

· /cgi-bin/userConfig.cgi
· /photo/slideshow.php
· /photo/p/api/album.php
· /cgi-bin/authLogin.cgi
· /photo/p/api/video.php

Pre-disclosure activity

all early actors →

Analysing probe history around the publication date…

Recent probe volume (last 7 days)

peak: 106 events/day

eventsdistinct IPs

Downloads & integrations

CSV (source IPs)JSON Save as feed

Top sources probing for CVE-2019-7194

Top networks the attempts come from

Fingerprints of the clients exploiting this

The HTTP (JA4H) and TLS (JA4) fingerprints seen on these attempts. Click one to see the whole population that carries it.

ja4h: ge11nn0300_86b6b04cb9cc ja4h: ge11nn0400_88d30a62b7ad ja4h: po11nn0600_5aaf82b7b36c ja4h: ge11nn15en_a743836884df ja4h: ge11nn0300_0db47b7d240d ja4h: po11nn0500_b4ba55311b46 ja4: t13i190800_9dc949149365_97f8aa674fd9 ja4: t12i330500_5172cef6ed69_021165082e1c ja4: t13i250900_b78ed14e2fd0_e7c285222651

Sample request paths observed

/cgi-bin/authLogin.cgi
/photo/slideshow.php?album=
/photo/p/api/album.php
/photo/p/api/video.php