What’s Vulnerable › Vulnerabilities

CVE-2018-19949: QNAP NAS File Station Command Injection Vulnerability

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: yes — in CISA KEV since 2022-05-24
• EPSS: 30.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2020-10-28 · updated 2026-10-02
• Weakness: CWE-20

Description

If exploited, this command injection vulnerability could allow remote attackers to run arbitrary commands. QNAP has already fixed the issue in the following QTS versions. QTS 4.4.2.1231 on build 20200302; QTS 4.4.1.1201 on build 20200130; QTS 4.3.6.1218 on build 20200214; QTS 4.3.4.1190 on build 20200107; QTS 4.3.3.1161 on build 20200109; QTS 4.2.6 on build 20200109.

Affected products

• QNAP QTS: before 4.2.6; from 4.3.1.0013 before 4.3.3.1161; from 4.3.4 before 4.3.4.1190; from 4.3.6 before 4.3.6.1218; from 4.4.0 before 4.4.1.1201; from 4.4.2 before 4.4.2.1231 — fixed in 4.2.6, 4.3.3.1161, 4.3.4.1190, 4.3.6.1218, 4.4.1.1201, 4.4.2.1231

How to fix

Upgrade to a fixed version: QNAP QTS 4.2.6, 4.3.3.1161, 4.3.4.1190, 4.3.6.1218. Check the vendor advisory for mitigations.

References

• https://www.qnap.com/zh-tw/security-advisory/qsa-20-01
• https://www.qnap.com/zh-tw/security-advisory/qsa-20-01
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-19949

Get alerted when CVE-2018-19949 or the next vulnerability affects your stack