Actively exploited in the wild
QNAP NAS File Station Command Injection Vulnerability
QNAP - Network Attached Storage (NAS) · Listed in the CISA KEV since 2022-05-24. This indicates confirmed attacks in production environments.
Required action: Apply updates per vendor instructions.
CVE-2018-19949
CriticalCVSS 9.8KEVExploitation Probability (EPSS)
Very high risk98th percentile - higher than 98% of all known CVEs
Summary
If exploited, this command injection vulnerability could allow remote attackers to run arbitrary commands. QNAP has already fixed the issue in the following QTS versions. QTS 4.4.2.1231 on build 20200302; QTS 4.4.1.1201 on build 20200130; QTS 4.3.6.1218 on build 20200214; QTS 4.3.4.1190 on build 20200107; QTS 4.3.3.1161 on build 20200109; QTS 4.2.6 on build 20200109.
Risk Assessment
An attacker can execute arbitrary commands on the QNAP device, potentially leading to full control and data access.
Recommendation
Update QTS to one of the listed patched versions.
Original NVD description (English source)
If exploited, this command injection vulnerability could allow remote attackers to run arbitrary commands. QNAP has already fixed the issue in the following QTS versions. QTS 4.4.2.1231 on build 20200302; QTS 4.4.1.1201 on build 20200130; QTS 4.3.6.1218 on build 20200214; QTS 4.3.4.1190 on build 20200107; QTS 4.3.3.1161 on build 20200109; QTS 4.2.6 on build 20200109.