CVE-2018-19949: QNAP NAS File Station Command Injection Vulnerability
Vulnerability summary
CVE-2018-19949 is a critical (CVSS 9.8) Improper Input Validation vulnerability in QNAP Network Attached Storage (NAS). It is known to be exploited: CISA lists it, first on 24-05-2022. It has been used in ransomware campaigns. EPSS estimates a 28.63% chance of exploitation in the next 30 days, higher than 98.1% of scored vulnerabilities.
Timeline
- 28-10-2020PublishedVulnerability first disclosed.
- 24-05-2022Added to CISA KEVQNAP NAS File Station Command Injection Vulnerability
- 14-06-2022CISA remediation dueApply updates per vendor instructions.
- 02-10-2026Last modifiedVulnerability information updated.
Description
If exploited, this command injection vulnerability could allow remote attackers to run arbitrary commands. QNAP has already fixed the issue in the following QTS versions. QTS 4.4.2.1231 on build 20200302; QTS 4.4.1.1201 on build 20200130; QTS 4.3.6.1218 on build 20200214; QTS 4.3.4.1190 on build 20200107; QTS 4.3.3.1161 on build 20200109; QTS 4.2.6 on build 20200109.
CVSS metrics
3 scores · 2 sources · 2 versions- NVDNIST9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
28.63%
Chance of exploitation in the next 30 days
Percentile
98%
Versus all other CVEs
30-day change
+4.18 pp
From 24.45% on 19-09-2026
Known exploited
Compare KEV catalogs
CISA KEVListed- Added
- 24-05-2022
- Federal due date
- 14-06-2022
CISA required action
Apply updates per vendor instructions. nvd.nist.gov/vuln/detail/CVE-2018-19949
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-20Improper Input ValidationThe product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
- CWE-77Improper Neutralization of Special Elements used in a Command ('Command Injection')The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.
- CWE-78Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
Affected systems
Qnap1 product
- qts< 4.2.6 | ≥ 4.3.1.0013, < 4.3.3.1161 | ≥ 4.3.4, < 4.3.4.1190 | ≥ 4.3.6, < 4.3.6.1218 | ≥ 4.4.0, < 4.4.1.1201 | ≥ 4.4.2, < 4.4.2.1231 | 4.2.6 | 4.2.6:build_20170517 | 4.2.6:build_20190322 | 4.2.6:build_20190730 | 4.2.6:build_20190921 | 4.2.6:build_20191107
Qnap systems inc.1 product
- qts≥ unspecified, < 4.4.2.1231 | ≥ unspecified, < 4.4.1.1201 | ≥ unspecified, < 4.3.6.1218 | ≥ unspecified, < 4.3.4.1190 | ≥ unspecified, < 4.3.3.1161 | ≥ unspecified, < 4.2.6
2 vendors · 2 products
References
2 links- www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-19949Government ResourceUS Government Resource