Actively exploited in the wild
QNAP NAS File Station Cross-Site Scripting Vulnerability
QNAP - Network Attached Storage (NAS) · Listed in the CISA KEV since 2022-05-24. This indicates confirmed attacks in production environments.
Required action: Apply updates per vendor instructions.
CVE-2018-19953
MediumCVSS 6.1KEVExploitation Probability (EPSS)
Very high risk98th percentile - higher than 98% of all known CVEs
Summary
A cross-site scripting (XSS) vulnerability in QNAP QTS systems could allow remote attackers to inject malicious code. Fixed in specific QTS versions.
Risk Assessment
An attacker could exploit XSS to hijack user sessions, steal data, or spread malware within the QNAP environment.
Recommendation
Update QTS to the versions listed in the description or later to mitigate the vulnerability.
Other vulnerabilities in QNAP QTS
See all- CVE-2017-7629High
QNAP QTS before version 4.2.6 build 20170517 has a flaw in the change password function.
- CVE-2017-5227High
QNAP QTS before version 4.2.4 Build 20170313 allows local users to obtain sensitive Domain Administrator password information by reading data in an XOR format within the /etc/config/uLinux.conf configuration file.
- CVE-2015-6003High
CVE-2015-6003 is a directory traversal vulnerability in QNAP QTS before version 4.1.4 build 0910 and 4.2.x before version 4.2.0 RC2 build 0910, when AFP is enabled. It allows remote attackers to read or write to arbitrary files by leveraging access to an OS X user or guest account.
- CVE-2018-19949CriticalActively exploited
If exploited, this command injection vulnerability could allow remote attackers to run arbitrary commands. QNAP has already fixed the issue in the following QTS versions. QTS 4.4.2.1231 on build 20200302; QTS 4.4.1.1201 on build 20200130; QTS 4.3.6.1218 on build 20200214; QTS 4.3.4.1190 on build 20200107; QTS 4.3.3.1161 on build 20200109; QTS 4.2.6 on build 20200109.
- CVE-2018-19943HighActively exploited
A cross-site scripting (XSS) vulnerability in QNAP QTS systems could allow remote attackers to inject malicious code. Fixed in specific QTS versions.
- CVE-2019-7193CriticalActively exploited
This improper input validation vulnerability allows remote attackers to inject arbitrary code to the system. To fix the vulnerability, QNAP recommend updating QTS to their latest versions.
- CVE-2017-17033Critical
A buffer overflow vulnerability in the password function in QNAP QTS versions 4.2.6, 4.3.3.0378, 4.3.4.0387 (Beta 2) and earlier could allow remote attackers to execute arbitrary code on NAS devices.
- CVE-2017-17030Critical
A buffer overflow vulnerability in the login function in QNAP QTS affects versions 4.2.6, 4.3.3.0378, 4.3.4.0387 (Beta 2) and earlier. This could allow remote attackers to execute arbitrary code on NAS devices.
- CVE-2017-17029Critical
A buffer overflow vulnerability in the login function in QNAP QTS affects versions 4.2.6 build 20171026, 4.3.3.0378 build 20171117, 4.3.4.0387 (Beta 2) build 20171116 and earlier. This could allow remote attackers to execute arbitrary code on NAS devices.
- CVE-2017-17028Critical
A buffer overflow vulnerability in external device function in QNAP QTS versions 4.2.6, 4.3.3.0378, 4.3.4.0387 (Beta 2) and earlier could allow remote attackers to execute arbitrary code on NAS devices.
Original NVD description (English source)
If exploited, this cross-site scripting vulnerability could allow remote attackers to inject malicious code. QNAP has already fixed the issue in the following QTS versions. QTS 4.4.2.1231 on build 20200302; QTS 4.4.1.1201 on build 20200130; QTS 4.3.6.1218 on build 20200214; QTS 4.3.4.1190 on build 20200107; QTS 4.3.3.1161 on build 20200109; QTS 4.2.6 on build 20200109.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS