CRITICAL🚩 CISA KEV⚡ EXPLOIT✓ PATCH🇵🇱 Wersja polska

CVE-2018-19949

CVSS 9.8v3.1pub. 2020-10-28upd. 2026-08-13

If exploited, this command injection vulnerability could allow remote attackers to run arbitrary commands. QNAP has already fixed the issue in the following QTS versions. QTS 4.4.2.1231 on build 20200302; QTS 4.4.1.1201 on build 20200130; QTS 4.3.6.1218 on build 20200214; QTS 4.3.4.1190 on build 20200107; QTS 4.3.3.1161 on build 20200109; QTS 4.2.6 on build 20200109.

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

  • Qnap Qts

    OS
    Qnap
    4.2.64.3.1.0013 – 4.3.3.1161 (excl.)4.3.4 – 4.3.4.1190 (excl.)< 4.2.64.4.0 – 4.4.1.1201 (excl.)4.4.2 – 4.4.2.1231 (excl.)4.3.6 – 4.3.6.1218 (excl.)

CISA KEV — detailsi

Vendori
QNAP
Producti
Network Attached Storage (NAS)
Added to KEVi
May 24, 2022
Remediation deadline (US Federal)i
June 14, 2022(overdue)
Ransomwarei
Active ransomware campaigns exploit this vulnerability
Required action (CISA)i

Apply updates per vendor instructions.

CISA descriptioni

A command injection vulnerability affecting QNAP NAS File Station could allow remote attackers to run commands.

🔴
IMMEDIATE ACTION
Actively exploited in the wild (CISA KEV). Patch immediately.
☠️WYKORZYSTYWANE W RANSOMWARE⏰CISA DEADLINE: 14 czerwca 2022
Tags
Command Injection
CWE
References

Related vulnerabilities

CVE-2022-27593CRITICAL10.0⚠ KEVPL ✓same product

QNAP Photo Station — niekontrolowane odniesienie do zewnętrznego zasobu (RCE/modyfikacja plików)

CVE-2021-28799CRITICAL10.0⚠ KEVPL ✓same product

QNAP HBS 3 — nieautoryzowane logowanie zdalne do urządzenia NAS

CVE-2020-2509CRITICAL9.8⚠ KEVPL ✓same product

Command injection w QNAP QTS i QuTS hero — zdalne wykonanie kodu

CVE-2019-7195CRITICAL9.8⚠ KEVPL ✓same product

QNAP Photo Station — path traversal umożliwiający dostęp do plików systemowych

CVE-2019-7192CRITICAL9.8⚠ KEVPL ✓same product

QNAP Photo Station — nieautoryzowany dostęp zdalny (RCE)