CVE-2018-19943

Assessment

Why it matters

CISA lists this vulnerability as known to be exploited; exploitation is confirmed; EPSS is 17.7%; technical severity is CVSS 5.4.

If exploited, this cross-site scripting vulnerability could allow remote attackers to inject malicious code. QNAP has already fixed these issues in the following QTS versions. QTS 4.4.2.1270 build 20200410 and later QTS 4.4.1.1261 build 20200330 and later QTS 4.3.6.1263 build 20200330 and later QTS 4.3.4.1282 build 20200408 and later QTS 4.3.3.1252 build 20200409 and later QTS 4.2.6 build 20200421 and later

Who should care

• Teams operating Network Attached Storage (NAS), QTS
• Vulnerability and exposure management teams
• Security operations teams monitoring exploitation activity

Response plan

What I would do

1. Confirm whether Network Attached Storage (NAS), QTS is present in the environment.
2. Identify affected versions and establish whether vulnerable services are exposed or reachable.
3. Vendor advisory from www.qnap.com
4. Review relevant security telemetry for evidence of attempted or successful exploitation.
5. Document the remediation decision and track it to verified completion.

Technical details

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

CWE

CWE-79

Affected versions

QNAP Network Attached Storage (NAS); QNAP QTS (End Excluding 4.2.6 | Start Including 4.3.1.0013, End Excluding 4.3.3.1252 | Start Including 4.3.4, End Excluding 4.3.4.1282 | Start Including 4.3.6, End Excluding 4.3.6.1263)

Fixed versions

QNAP QTS (Fixed from 4.2.6, 4.3.3.1252, 4.3.4.1282, 4.3.6.1263, 4.4.1.1261, 4.4.2.1270)

Published

28 October 2020

Attack vector

Network

Privileges required

Low

User interaction

Required

Signal timeline

1. 28 Oct 2020CVE published
2. 23 May 2022Added to CISA KEV
3. 21 Aug 2026Latest EPSS score: 17.7%
4. 19 Aug 2026 · 12:58 UTCSignal calculated at 72

External references

• CISA Government advisory CVE-2018-19943 ↗
• Qnap Technical reference Qsa 20 01 ↗