CVE-2018-19950: Command Injection
Published Nov 2, 2020
·Updated
If exploited, this command injection vulnerability could allow remote attackers to execute arbitrary commands. This issue affects: QNAP Systems Inc. Music Station versions prior to 5.1.13; versions prior to 5.2.9; versions prior to 5.3.11.
Affected Software
7 affected components
QNAP Music Station>=5.3.0<5.3.11
QNAP QTS=4.4.3
QNAP Music Station<5.1.13
QNAP QTS=4.3.4
QNAP Music Station>=5.2.0<5.2.9
QNAP QTS=4.3.6
QNAP QTS=4.3.3
Remediation
Information
QNAP have already fixed the issue in the following Music Station:
QTS 4.3.3: Music Station 5.1.13 and later
QTS 4.3.4: Music Station 5.1.13 and later
QTS 4.3.6: Music Station 5.2.9 and later
QTS 4.4.3: Music Station 5.3.11 and later
Event History
Nov 2, 2020
CVE Published
via MITRE·03:57 PM
Data Sourced
via MITRE·03:57 PM
RemedyDescriptionWeakness
Frequently Asked Questions
1
What is CVE-2018-19950?
CVE-2018-19950 is a command injection vulnerability that could allow remote attackers to execute arbitrary commands.
2
Which software versions are affected by CVE-2018-19950?
Music Station versions prior to 5.1.13, versions prior to 5.2.9, and versions prior to 5.3.11 are affected by CVE-2018-19950.
3
How severe is CVE-2018-19950?
CVE-2018-19950 has a severity value of 9.8 (critical).
4
How can CVE-2018-19950 be fixed?
To fix CVE-2018-19950, users should update Music Station to version 5.1.13, 5.2.9, or 5.3.11.
5
Where can I find more information about CVE-2018-19950?
You can find more information about CVE-2018-19950 in the QNAP security advisory QSA-20-10.