CRITICAL

CVE-2018-19949

Qnap Qts 2020-10-28 CVSS v3.1

CVSS

9.8

KEV

Description

If exploited, this command injection vulnerability could allow remote attackers to run arbitrary commands. QNAP has already fixed the issue in the following QTS versions. QTS 4.4.2.1231 on build 20200302; QTS 4.4.1.1201 on build 20200130; QTS 4.3.6.1218 on build 20200214; QTS 4.3.4.1190 on build 20200107; QTS 4.3.3.1161 on build 20200109; QTS 4.2.6 on build 20200109.

Summary dbcve.org

This is a command injection vulnerability in QNAP QTS firmware that allows remote attackers to execute arbitrary commands on affected systems. The vulnerability stems from insufficient input validation in the QTS web interface, enabling malicious commands to be injected and executed with elevated privileges.

Mitigation

Apply the appropriate QTS patch/update based on the current firmware version: QTS 4.4.2.1231 (build 20200302), 4.4.1.1201 (build 20200130), 4.3.6.1218 (build 20200214), 4.3.4.1190 (build 20200107), 4.3.3.1161 (build 20200109), or 4.2.6 (build 20200109).

Weakness (CWE)

CWE-20 Improper Input Validation

CWE-77 Command Injection

CWE-78 OS Command Injection

EPSS Score

28.42%

Probability of exploitation in next 30 days

98.1th percentile

References

https://www.qnap.com/zh-tw/security-advisory/qsa-20-01 Vendor Advisory https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-19949 US Government Resource

View on dbcve.org

Base CVE data derived from NVD (public domain). Enrichment by dbcve.org (CC-BY-4.0). Fetched via API.

Back to CVE