CVE-2018-19946: qnap systems inc. helpdesk Improper Certificate Validation
Vulnerability summary
CVE-2018-19946 is a medium (CVSS 5.9) Improper Certificate Validation vulnerability in qnap systems inc. helpdesk. EPSS estimates a 0.32% chance of exploitation in the next 30 days, higher than 22.9% of scored vulnerabilities.
Timeline
- 11-09-2020PublishedVulnerability first disclosed.
- 05-08-2024Last modifiedVulnerability information updated.
Description
The vulnerability have been reported to affect earlier versions of Helpdesk. If exploited, this improper certificate validation vulnerability could allow an attacker to spoof a trusted entity by interfering in the communication path between the host and client. QNAP has already fixed the issue in Helpdesk 3.0.3 and later.
CVSS metrics
3 scores · 2 sources · 2 versions- CVE.orgCNA4.2MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:NDiffers
EPSS trend
Probability
0.32%
Chance of exploitation in the next 30 days
Percentile
23%
Versus all other CVEs
30-day change
0.00 pp
From 0.32% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-295Improper Certificate ValidationThe product does not validate, or incorrectly validates, a certificate.
- CWE-297Improper Validation of Certificate with Host MismatchThe product communicates with a host that provides a certificate, but the product does not properly ensure that the certificate is actually associated with that host.
Affected systems
2 vendors · 2 products