CVE-2018-19949: QNAP NAS File Station Command Injection Vulnerability

Q: What is CVE-2018-19949?

CVE-2018-19949 is a command injection vulnerability found in QNAP NAS File Station.

Q: How severe is CVE-2018-19949?

CVE-2018-19949 has a severity rating of 9.8, which is considered critical.

Q: How can CVE-2018-19949 be exploited?

CVE-2018-19949 can be exploited by remote attackers to run arbitrary commands.

Q: Which QTS versions have fixed CVE-2018-19949?

CVE-2018-19949 has been fixed in the following QTS versions: QTS 4.4.2.1231 (build 20200302), QTS 4.4.1.1201 (build 20200130), QTS 4.3.6.1218 (build 20200214), QTS 4.3.4.1190 (build 20200329).

Q: Where can I find more information about CVE-2018-19949?

You can find more information about CVE-2018-19949 and the fix in the QNAP security advisory QSA-20-01.

Published Oct 28, 2020

Updated

If exploited, this command injection vulnerability could allow remote attackers to run arbitrary commands. QNAP has already fixed the issue in the following QTS versions. QTS 4.4.2.1231 on build 20200302; QTS 4.4.1.1201 on build 20200130; QTS 4.3.6.1218 on build 20200214; QTS 4.3.4.1190 on build 20200107; QTS 4.3.3.1161 on build 20200109; QTS 4.2.6 on build 20200109.

Other sources

A command injection vulnerability affecting QNAP NAS File Station could allow remote attackers to run commands.

— CISA

Affected Software

13 affected components

QNAP QTS<4.2.6

QNAP QTS>=4.3.1.0013<4.3.3.1161

QNAP QTS>=4.3.4<4.3.4.1190

QNAP QTS>=4.3.6<4.3.6.1218

QNAP QTS>=4.4.0<4.4.1.1201

QNAP QTS>=4.4.2<4.4.2.1231

QNAP QTS=4.2.6

QNAP QTS=4.2.6-build_20170517

QNAP QTS=4.2.6-build_20190322

QNAP QTS=4.2.6-build_20190730

QNAP QTS=4.2.6-build_20190921

QNAP QTS=4.2.6-build_20191107

QNAP Network Attached Storage (NAS)

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade QNAP NAS File Station (QTS) to a version that resolves this vulnerability.
Fixed in 4.4.2.1231Patch build 20200302
Upgrade
Upgrade QNAP NAS File Station (QTS) to a version that resolves this vulnerability.
Fixed in 4.4.1.1201Patch build 20200130
Upgrade
Upgrade QNAP NAS File Station (QTS) to a version that resolves this vulnerability.
Fixed in 4.3.6.1218Patch build 20200214
Upgrade
Upgrade QNAP NAS File Station (QTS) to a version that resolves this vulnerability.
Fixed in 4.3.4.1190Patch build 20200107
Upgrade
Upgrade QNAP NAS File Station (QTS) to a version that resolves this vulnerability.
Fixed in 4.3.3.1161Patch build 20200109
Upgrade
Upgrade QNAP NAS File Station (QTS) to a version that resolves this vulnerability.
Fixed in 4.2.6Patch build 20200109

Event History

Oct 28, 2020

CVE Published

via MITRE·05:55 PM

Data Sourced

via MITRE·05:55 PM

DescriptionWeakness

Data Sourced

via NVD·06:15 PM

DescriptionSeverityWeaknessAffected Software

May 24, 2022

Known Exploited

via CISA·12:00 AM

Known Ransomware

via CISA·12:00 AM

Frequently Asked Questions

What is CVE-2018-19949?

CVE-2018-19949 is a command injection vulnerability found in QNAP NAS File Station.

How severe is CVE-2018-19949?