All vulnerabilities
CVE-2018-19949

Network Attached Storage (NAS): QNAP NAS File Station Command Injection Vulnerability

QNAP Network Attached Storage (NAS)Network & edge
Open in ThreatlineRecord JSON
CVSS
9.8Critical
ExploitationExploited in the wildAdded to KEV 24 May 2022. Known ransomware useCISA KEV
Exploit odds (EPSS)30.2%Chance of exploitation activity in the next 30 days, higher than 98% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in4.4.2.1231Also 4.4.1.1201, 4.3.6.1218 and 3 moreCVE List
Federal deadline14 Jun 2022Remediation due date for US federal agenciesCISA KEV
CISA required actionApply updates per vendor instructions. CISA KEV

What fixes it

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Timeline

  1. 28 Oct 2020, 17:55 UTCPublishedCVE List
  2. 24 May 2022Added to CISA KEVCISA KEV

Description

A command injection vulnerability affecting QNAP NAS File Station could allow remote attackers to run commands.

Text from CVE List

Affected versions 6

  • QTSaffected: unspecified before 4.4.2.1231CVE List
  • QTSaffected: unspecified before 4.4.1.1201CVE List
  • QTSaffected: unspecified before 4.3.6.1218CVE List
  • QTSaffected: unspecified before 4.3.4.1190CVE List
  • QTSaffected: unspecified before 4.3.3.1161CVE List
  • QTSaffected: unspecified before 4.2.6CVE List

References 3