CVE-2018-19949

CriticalCVSS 9.8/10Known exploited (CISA KEV)Last modified Oct 2, 2026

Description

If exploited, this command injection vulnerability could allow remote attackers to run arbitrary commands. QNAP has already fixed the issue in the following QTS versions. QTS 4.4.2.1231 on build 20200302; QTS 4.4.1.1201 on build 20200130; QTS 4.3.6.1218 on build 20200214; QTS 4.3.4.1190 on build 20200107; QTS 4.3.3.1161 on build 20200109; QTS 4.2.6 on build 20200109.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-20 CWE-77 CWE-78

Affected software

Vendor	Product	Versions
QNAP Systems Inc.	QTS	>= unspecified, < 4.4.2.1231
QNAP Systems Inc.	QTS	>= unspecified, < 4.4.1.1201
QNAP Systems Inc.	QTS	>= unspecified, < 4.3.6.1218
QNAP Systems Inc.	QTS	>= unspecified, < 4.3.4.1190
QNAP Systems Inc.	QTS	>= unspecified, < 4.3.3.1161; >= unspecified, < 4.2.6

References

https://www.qnap.com/zh-tw/security-advisory/qsa-20-01Vendor Advisory
https://www.qnap.com/zh-tw/security-advisory/qsa-20-01Vendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-19949US Government Resource

Timeline

Published: Oct 28, 2020
Last modified: Oct 2, 2026
Added to CISA KEV: May 24, 2022
NVD status: Analyzed

Related CVEs from 2018

CVE-2018-199509.8If exploited, this command injection vulnerability could allow remote attackers to execute arbitrary commands. This issue affects: QNAP Syst CVE-2018-199516.1If exploited, this cross-site scripting vulnerability could allow remote attackers to inject malicious code. This issue affects: QNAP System CVE-2018-199527.5If exploited, this SQL injection vulnerability could allow remote attackers to obtain application information. This issue affects: QNAP Syst CVE-2018-199536.1If exploited, this cross-site scripting vulnerability could allow remote attackers to inject malicious code. QNAP has already fixed the issu CVE-2018-199546.1The cross-site scripting vulnerability has been reported to affect earlier versions of Photo Station. If exploited, the vulnerability could CVE-2018-199556.1The cross-site scripting vulnerability has been reported to affect earlier versions of Photo Station. If exploited, the vulnerability could CVE-2018-199566.1The cross-site scripting vulnerability has been reported to affect earlier versions of Photo Station. If exploited, the vulnerability could CVE-2018-199576.1A vulnerability involving insufficient HTTP security headers has been reported to affect QNAP NAS running QTS, QuTS hero, and QuTScloud. Thi CVE-2018-19965.3IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could provide weaker than expected security, caused by the improper TLS configuratio CVE-2018-199607.0The debug_mode function in web/web.py in OnionShare through 1.3.1, when --debug is enabled, uses the /tmp/onionshare_server.log pathname for CVE-2018-199617.8An issue was discovered in Xen through 4.11.x on AMD x86 platforms, possibly allowing guest OS users to gain host OS privileges because TLB CVE-2018-199627.8An issue was discovered in Xen through 4.11.x on AMD x86 platforms, possibly allowing guest OS users to gain host OS privileges because smal