QNAP · Network Attached Storage (NAS)
CVE-2018-19949
QNAP NAS File Station Command Injection Vulnerability
What it is
If exploited, this command injection vulnerability could allow remote attackers to run arbitrary commands. QNAP has already fixed the issue in the following QTS versions. QTS 4.4.2.1231 on build 20200302; QTS 4.4.1.1201 on build 20200130; QTS 4.3.6.1218 on build 20200214; QTS 4.3.4.1190 on build 20200107; QTS 4.3.3.1161 on build 20200109; QTS 4.2.6 on build 20200109.
CISA: A command injection vulnerability affecting QNAP NAS File Station could allow remote attackers to run commands.
What to do
Apply updates per vendor instructions.
Deadline for US federal agencies: June 14, 2022
- Added to the CISA list
- May 24, 2022
- Published
- October 28, 2020
- Severity
- Critical 9.8 CVSS 3.1
- Chance of attacks in the next 30 days (EPSS)
- 30% in the top 1.8% of all known vulnerabilities
- Weakness
- CWE-20 CWE-77 CWE-78
- More details
- NVD · CVE.org · CISA
All references (1)
More exploited flaws from QNAP
| Added | Vulnerability | Product | Severity | Attack chance |
|---|---|---|---|---|
| May 24, 2022 | NAS File Station Cross-Site Scripting | Network Attached Storage (NAS) | High 8.0 | 23% |
| May 24, 2022 | NAS File Station Cross-Site Scripting | Network Attached Storage (NAS) | Medium 6.1 | 31% |
| Mar 31, 2022 | NAS Improper Authorization | Network Attached Storage (NAS) | Critical 10.0 | 78% |
| Dec 21, 2023 | OS Command Injection | VioStor NVR | High 8.0 | 73% |
| Sep 8, 2022 | Externally Controlled Reference | Photo Station | Critical 10.0 | 88% |
| Jun 8, 2022 | Improper Access Control | Photo Station | Critical 9.8 | 88% |
| Jun 8, 2022 | Improper Input Validation | QTS | Critical 9.8 | 14% |
| Jun 8, 2022 | Path Traversal | Photo Station | Critical 9.8 | 83% |
Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.