CISA KEV by vendor
QNAP vulnerabilities in the CISA KEV catalogue
11 QNAP entries in CISA's Known Exploited Vulnerabilities catalogue, 9 of them (82 percent) known to have been used in ransomware campaigns. First added 31 March 2022, latest 21 December 2023.
Data status: a source is stale
Last synced CISA catalogue version 2026.11.04 (released 4 November 2026) 1,768 entries Updated manually
11entries, 0.6% of the catalogue
9known ransomware use
0added in the last 7 days
0federal due dates in the next 14 days
Products
| Product, as CISA names it | Entries |
|---|---|
| Photo Station | 4 |
| Network Attached Storage (NAS) | 4 |
| VioStor NVR | 1 |
| QTS | 1 |
| QNAP Network-Attached Storage (NAS) | 1 |
Latest additions
| CVE | Product | Added | Due | Ransomware | CVSS | EPSS | SSVC | Exposed asset window |
|---|---|---|---|---|---|---|---|---|
| CVE-2023-47565 | VioStor NVR | 2023-12-21 | 2024-01-11 | Unknown | 8.8 High | 73.2% | Not auto, total | 3 days + triage |
| CVE-2022-27593 | Photo Station | 2022-09-08 | 2022-09-29 | Known | 9.1 Critical | 87.9% | Auto, partial | 3 days |
| CVE-2019-7195 | Photo Station | 2022-06-08 | 2022-06-22 | Known | 9.8 Critical | 89.3% | Auto, total | 3 days + triage |
| CVE-2019-7194 | Photo Station | 2022-06-08 | 2022-06-22 | Known | 9.8 Critical | 82.7% | Auto, total | 3 days + triage |
| CVE-2019-7193 | QTS | 2022-06-08 | 2022-06-22 | Known | 9.8 Critical | 14.3% | Auto, total | 3 days + triage |
| CVE-2019-7192 | Photo Station | 2022-06-08 | 2022-06-22 | Known | 9.8 Critical | 88.1% | Auto, total | 3 days + triage |
| CVE-2018-19953 | Network Attached Storage (NAS) | 2022-05-24 | 2022-06-14 | Known | 6.1 Medium | 30.5% | Not auto, total | 3 days + triage |
| CVE-2018-19949 | Network Attached Storage (NAS) | 2022-05-24 | 2022-06-14 | Known | 9.8 Critical | 30.1% | Auto, total | 3 days + triage |
| CVE-2018-19943 | Network Attached Storage (NAS) | 2022-05-24 | 2022-06-14 | Known | 5.4 Medium | 22.6% | Not auto, total | 3 days + triage |
| CVE-2020-2509 | QNAP Network-Attached Storage (NAS) | 2022-04-11 | 2022-05-02 | Unknown | 9.8 Critical | 33.9% | Auto, total | 3 days + triage |
All 11 entries
| CVE | Product | Added | Due | Ransomware | CVSS | EPSS | SSVC | Exposed asset window |
|---|---|---|---|---|---|---|---|---|
| CVE-2023-47565 | VioStor NVR | 2023-12-21 | 2024-01-11 | Unknown | 8.8 High | 73.2% | Not auto, total | 3 days + triage |
| CVE-2022-27593 | Photo Station | 2022-09-08 | 2022-09-29 | Known | 9.1 Critical | 87.9% | Auto, partial | 3 days |
| CVE-2019-7195 | Photo Station | 2022-06-08 | 2022-06-22 | Known | 9.8 Critical | 89.3% | Auto, total | 3 days + triage |
| CVE-2019-7194 | Photo Station | 2022-06-08 | 2022-06-22 | Known | 9.8 Critical | 82.7% | Auto, total | 3 days + triage |
| CVE-2019-7193 | QTS | 2022-06-08 | 2022-06-22 | Known | 9.8 Critical | 14.3% | Auto, total | 3 days + triage |
| CVE-2019-7192 | Photo Station | 2022-06-08 | 2022-06-22 | Known | 9.8 Critical | 88.1% | Auto, total | 3 days + triage |
| CVE-2018-19953 | Network Attached Storage (NAS) | 2022-05-24 | 2022-06-14 | Known | 6.1 Medium | 30.5% | Not auto, total | 3 days + triage |
| CVE-2018-19949 | Network Attached Storage (NAS) | 2022-05-24 | 2022-06-14 | Known | 9.8 Critical | 30.1% | Auto, total | 3 days + triage |
| CVE-2018-19943 | Network Attached Storage (NAS) | 2022-05-24 | 2022-06-14 | Known | 5.4 Medium | 22.6% | Not auto, total | 3 days + triage |
| CVE-2020-2509 | QNAP Network-Attached Storage (NAS) | 2022-04-11 | 2022-05-02 | Unknown | 9.8 Critical | 33.9% | Auto, total | 3 days + triage |
| CVE-2021-28799 | Network Attached Storage (NAS) | 2022-03-31 | 2022-04-21 | Known | 9.8 Critical | 78.2% | Auto, total | 3 days + triage |
Due dates bind US federal civilian executive branch agencies only (BOD 26-04). Filter QNAP in the tracker by date, score or status.
Source: CISA Known Exploited Vulnerabilities Catalog; NVD, FIRST EPSS and CISA SSVC for the scores. This product uses data from the NVD API but is not endorsed or certified by the NVD. CISA does not endorse Sysprobs.