QNAP · Network Attached Storage (NAS)

CVE-2018-19943

QNAP NAS File Station Cross-Site Scripting Vulnerability

Exploited in attacks Used by ransomware High 8.0 Attack chance: 23%

What it is

If exploited, this cross-site scripting vulnerability could allow remote attackers to inject malicious code. QNAP has already fixed these issues in the following QTS versions. QTS 4.4.2.1270 build 20200410 and later QTS 4.4.1.1261 build 20200330 and later QTS 4.3.6.1263 build 20200330 and later QTS 4.3.4.1282 build 20200408 and later QTS 4.3.3.1252 build 20200409 and later QTS 4.2.6 build 20200421 and later

CISA: A cross-site scripting vulnerability affecting QNAP NAS File Station could allow remote attackers to inject malicious code.

What to do

Apply updates per vendor instructions.

Deadline for US federal agencies: June 14, 2022

Added to the CISA list: May 24, 2022
Published: October 28, 2020
Severity: High 8.0 CVSS 3.1
Chance of attacks in the next 30 days (EPSS): 23% in the top 2.3% of all known vulnerabilities
Weakness: CWE-79 CWE-80
More details: NVD · CVE.org · CISA

All references (1)

https://www.qnap.com/zh-tw/security-advisory/qsa-20-01

More exploited flaws from QNAP

Added	Vulnerability	Product	Severity	Attack chance
May 24, 2022	NAS File Station Command InjectionCVE-2018-19949used by ransomware	Network Attached Storage (NAS)	Critical 9.8	30%
May 24, 2022	NAS File Station Cross-Site ScriptingCVE-2018-19953used by ransomware	Network Attached Storage (NAS)	Medium 6.1	31%
Mar 31, 2022	NAS Improper AuthorizationCVE-2021-28799used by ransomware	Network Attached Storage (NAS)	Critical 10.0	78%
Dec 21, 2023	OS Command InjectionCVE-2023-47565	VioStor NVR	High 8.0	73%
Sep 8, 2022	Externally Controlled ReferenceCVE-2022-27593used by ransomware	Photo Station	Critical 10.0	88%
Jun 8, 2022	Improper Access ControlCVE-2019-7192used by ransomware	Photo Station	Critical 9.8	88%
Jun 8, 2022	Improper Input ValidationCVE-2019-7193used by ransomware	QTS	Critical 9.8	14%
Jun 8, 2022	Path TraversalCVE-2019-7194used by ransomware	Photo Station	Critical 9.8	83%

All of them →

Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.