CVE-2018-19944: qnap systems inc. qts Missing Encryption of Sensitive Data
Vulnerability summary
CVE-2018-19944 is a high (CVSS 7.5) Missing Encryption of Sensitive Data vulnerability in qnap systems inc. qts. EPSS estimates a 0.83% chance of exploitation in the next 30 days, higher than 56.7% of scored vulnerabilities.
Timeline
- 31-12-2020PublishedVulnerability first disclosed.
- 17-09-2024Last modifiedVulnerability information updated.
Description
A cleartext transmission of sensitive information vulnerability has been reported to affect certain QTS devices. If exploited, this vulnerability allows a remote attacker to gain access to sensitive information. QNAP have already fixed this vulnerability in the following versions: QTS 4.4.3.1354 build 20200702 (and later)
CVSS metrics
2 scores · 1 source · 2 versionsEPSS trend
Probability
0.83%
Chance of exploitation in the next 30 days
Percentile
57%
Versus all other CVEs
30-day change
+0.01 pp
From 0.82% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-311Missing Encryption of Sensitive DataThe product does not encrypt sensitive or critical information before storage or transmission.
- CWE-319Cleartext Transmission of Sensitive InformationThe product transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.
Affected systems
2 vendors · 2 products