9.8

CVE-2018-19949

Warning

If exploited, this command injection vulnerability could allow remote attackers to run arbitrary commands. QNAP has already fixed the issue in the following QTS versions. QTS 4.4.2.1231 on build 20200302; QTS 4.4.1.1201 on build 20200130; QTS 4.3.6.1218 on build 20200214; QTS 4.3.4.1190 on build 20200107; QTS 4.3.3.1161 on build 20200109; QTS 4.2.6 on build 20200109.

Data is provided by the National Vulnerability Database (NVD)
Qnap ≫ Qts Version < 4.2.6
Qnap ≫ Qts Version >= 4.3.1.0013 < 4.3.3.1161
Qnap ≫ Qts Version >= 4.3.4 < 4.3.4.1190
Qnap ≫ Qts Version >= 4.3.6 < 4.3.6.1218
Qnap ≫ Qts Version >= 4.4.0 < 4.4.1.1201
Qnap ≫ Qts Version >= 4.4.2 < 4.4.2.1231
Qnap ≫ Qts Version4.2.6 Update-
Qnap ≫ Qts Version4.2.6 Updatebuild_20170517
Qnap ≫ Qts Version4.2.6 Updatebuild_20190322
Qnap ≫ Qts Version4.2.6 Updatebuild_20190730
Qnap ≫ Qts Version4.2.6 Updatebuild_20190921
Qnap ≫ Qts Version4.2.6 Updatebuild_20191107

24.05.2022: CISA Known Exploited Vulnerabilities (KEV) Catalog

QNAP NAS File Station Command Injection Vulnerability

Vulnerability

A command injection vulnerability affecting QNAP NAS File Station could allow remote attackers to run commands.

Description

Apply updates per vendor instructions.

Required actions
EPSS Metriken
Type Source Score Percentile
EPSS FIRST.org 49.21% 0.977
CVSS Metriken
Source Base Score Exploit Score Impact Score Vector string
nvd@nist.gov 9.8 3.9 5.9
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvd@nist.gov 7.5 10 6.4
AV:N/AC:L/Au:N/C:P/I:P/A:P
134c704f-9b21-4f2e-91b3-4a467353bcc0 9.8 3.9 5.9
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE-20 Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')

The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.

CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.