⚠ Actively exploited in ransomware campaigns
This vulnerability is on the CISA Known Exploited Vulnerabilities list and has been used in known ransomware attacks. CISA required action: Apply updates per vendor instructions.. Due date: 2022-06-14.

CVE-2018-19949 — Improper Input Validation in Systems INC QTS

CWE-20 — Improper Input ValidationCWE-77 — Command InjectionCWE-78 — OS Command Injection5 documents5 sources
Severity
9.8CRITICALNVD
EPSS
44.2%
top 2.44%
CISA KEV
KEVRansomware
Added 2022-05-24
Due 2022-06-14
Exploit
Exploited in wild
Active exploitation observed
Affected products
2
Qnap Systems INC QTSQnap QTS
Timeline
PublishedOct 28
KEV addedMay 24
KEV dueJun 14
CISA Required Action: Apply updates per vendor instructions.

Description

If exploited, this command injection vulnerability could allow remote attackers to run arbitrary commands. QNAP has already fixed the issue in the following QTS versions. QTS 4.4.2.1231 on build 20200302; QTS 4.4.1.1201 on build 20200130; QTS 4.3.6.1218 on build 20200214; QTS 4.3.4.1190 on build 20200107; QTS 4.3.3.1161 on build 20200109; QTS 4.2.6 on build 20200109.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9

Affected Packages2 packages

▶NVDqnap/qts4.3.1.0013 — 4.3.3.1161+6
▶CVEListV5qnap_systems_inc/qtsunspecified — 4.4.2.1231+5

🔴Vulnerability Details

3
GHSA
GHSA-h9cw-v634-8jcw: If exploited, this command injection vulnerability could allow remote attackers to run arbitrary commands↗2022-05-24
▶
CVEList
CVE-2018-19949: If exploited, this command injection vulnerability could allow remote attackers to run arbitrary commands↗2020-10-28
▶
VulnCheck
QNAP NAS File Station Command Injection Vulnerability↗2018
▶

📋Vendor Advisories

1
CISA
QNAP NAS File Station Command Injection Vulnerability↗2022-05-24
▶
CVE-2018-19949 — Improper Input Validation | cvebase