Critical severity · published Oct 28, 2020
CVE-2018-19949
QNAP NAS File Station Command Injection Vulnerability
RansomwareIn wildKEV
9.8
CVSS
30.2%
EPSS
Yes
On KEV
Description
If exploited, this command injection vulnerability could allow remote attackers to run arbitrary commands. QNAP has already fixed the issue in the following QTS versions. QTS 4.4.2.1231 on build 20200302; QTS 4.4.1.1201 on build 20200130; QTS 4.3.6.1218 on build 20200214; QTS 4.3.4.1190 on build 20200107; QTS 4.3.3.1161 on build 20200109; QTS 4.2.6 on build 20200109.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)30.2% · higher than 98% of CVEs
Exploited in the wildYes
CISA KEVListed May 24, 2022
Federal remediation dueJun 14, 2022
Ransomware campaign useKnown
Affected products
Which versions
QT
QTS · QNAP Systems Inc.
before 4.4.2.1231; before 4.4.1.1201; before 4.3.6.1218; before 4.3.4.1190; before 4.3.3.1161; before 4.2.6 · source: vendor, NVD
NA
Network Attached Storage (NAS) · QNAP
All versions, or not specified · source: KEV
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2018-19949
CVE.org
https://www.cve.org/CVERecord?id=CVE-2018-19949
CISA KEV catalogue
https://www.cisa.gov/known-exploited-vulnerabilities-catalog
x_refsource_MISC
https://www.qnap.com/zh-tw/security-advisory/qsa-20-01
More from QTS
9.8
CVE-2020-2509
Command Injection Vulnerability in QTS and QuTS hero
6.1
CVE-2018-19953
QNAP NAS File Station Cross-Site Scripting Vulnerability
5.4
CVE-2018-19943
QNAP NAS File Station Cross-Site Scripting Vulnerability
9.8
CVE-2025-66276
QuTS hero is not affected
9.8
CVE-2025-66277
QTS, QuTS hero