CVE-2018-19949

Assessment

Why it matters

CISA lists this vulnerability as known to be exploited; exploitation is confirmed; EPSS is 24.4%; technical severity is CVSS 9.8.

If exploited, this command injection vulnerability could allow remote attackers to run arbitrary commands. QNAP has already fixed the issue in the following QTS versions. QTS 4.4.2.1231 on build 20200302; QTS 4.4.1.1201 on build 20200130; QTS 4.3.6.1218 on build 20200214; QTS 4.3.4.1190 on build 20200107; QTS 4.3.3.1161 on build 20200109; QTS 4.2.6 on build 20200109.

Who should care

• Teams operating Network Attached Storage (NAS), QTS
• Vulnerability and exposure management teams
• Security operations teams monitoring exploitation activity

Response plan

What I would do

1. Confirm whether Network Attached Storage (NAS), QTS is present in the environment.
2. Identify affected versions and establish whether vulnerable services are exposed or reachable.
3. Vendor advisory from www.qnap.com
4. Review relevant security telemetry for evidence of attempted or successful exploitation.
5. Document the remediation decision and track it to verified completion.

Technical details

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-20

Affected versions

QNAP Network Attached Storage (NAS); QNAP QTS (End Excluding 4.2.6 | Start Including 4.3.1.0013, End Excluding 4.3.3.1161 | Start Including 4.3.4, End Excluding 4.3.4.1190 | Start Including 4.3.6, End Excluding 4.3.6.1218)

Fixed versions

QNAP QTS (Fixed from 4.2.6, 4.3.3.1161, 4.3.4.1190, 4.3.6.1218, 4.4.1.1201, 4.4.2.1231)

Published

28 October 2020

Attack vector

Network

Privileges required

None

User interaction

None

Signal timeline

1. 28 Oct 2020CVE published
2. 23 May 2022Added to CISA KEV
3. 21 Aug 2026Latest EPSS score: 24.4%
4. 19 Aug 2026 · 12:58 UTCSignal calculated at 78

External references

• CISA Government advisory CVE-2018-19949 ↗
• Qnap Technical reference Qsa 20 01 ↗