6.1

CVE-2018-19953: QNAP NAS File Station Cross-Site Scripting Vulnerability

CVSS: 6.1v3.1MediumKEVRansomwareAnalyzed
Published 28-10-2020Last modified 01-10-2026
Open JSON

Vulnerability summary

CVE-2018-19953 is a medium (CVSS 6.1) Cross-site Scripting vulnerability in QNAP Network Attached Storage (NAS). It is known to be exploited: CISA lists it, first on 24-05-2022. It has been used in ransomware campaigns. EPSS estimates a 28.98% chance of exploitation in the next 30 days, higher than 98.1% of scored vulnerabilities.

Overall risk
90/100
0100
Critical · default modelHow is this calculated?
CVSS score
6.1/10
010
Medium · v3.1 (CVE.org)
EPSS score
28.98%
0%100%
High · +5.09 pp in 30 days
KEVListedCISA
RansomwareKnown useFlagged by CISA
Public exploits0No public exploits recorded

Timeline

  1. 28-10-2020
    PublishedVulnerability first disclosed.
  2. 24-05-2022
    Added to CISA KEVQNAP NAS File Station Cross-Site Scripting Vulnerability
  3. 14-06-2022
    CISA remediation dueApply updates per vendor instructions.
  4. 01-10-2026
    Last modifiedVulnerability information updated.

Description

If exploited, this cross-site scripting vulnerability could allow remote attackers to inject malicious code. QNAP has already fixed the issue in the following QTS versions. QTS 4.4.2.1231 on build 20200302; QTS 4.4.1.1201 on build 20200130; QTS 4.3.6.1218 on build 20200214; QTS 4.3.4.1190 on build 20200107; QTS 4.3.3.1161 on build 20200109; QTS 4.2.6 on build 20200109.

CVSS metrics

3 scores · 2 sources · 2 versions

EPSS trend

Probability

28.98%

Chance of exploitation in the next 30 days

Percentile

98%

Versus all other CVEs

30-day change

+5.09 pp

From 23.89% on 20-09-2026

20-09-202620-10-2026
EPSS score
28.98%

Known exploited

Compare KEV catalogs
CISA KEVListed
Added
24-05-2022
Federal due date
14-06-2022
Ransomware

CISA required action

Apply updates per vendor instructions. nvd.nist.gov/vuln/detail/CVE-2018-19953

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Qnap1 product
  • qts< 4.2.6 | ≥ 4.3.1.0013, < 4.3.3.1161 | ≥ 4.3.4, < 4.3.4.1190 | ≥ 4.3.6, < 4.3.6.1218 | ≥ 4.4.0, < 4.4.1.1201 | ≥ 4.4.2, < 4.4.2.1231 | 4.2.6 | 4.2.6:build_20170517 | 4.2.6:build_20190322 | 4.2.6:build_20190730 | 4.2.6:build_20190921 | 4.2.6:build_20191107
Qnap systems inc.1 product
  • qts≥ unspecified, < 4.4.2.1231 | ≥ unspecified, < 4.4.1.1201 | ≥ unspecified, < 4.3.6.1218 | ≥ unspecified, < 4.3.4.1190 | ≥ unspecified, < 4.3.3.1161 | ≥ unspecified, < 4.2.6

2 vendors · 2 products

References

2 links