CVE-2019-7198: Command Injection Vulnerability in QTS and QuTS hero
This command injection vulnerability allows attackers to execute arbitrary commands in a compromised application. QNAP have already fixed this vulnerability in the following versions of QTS and QuTS hero. QuTS hero h4.5.1.1472 build 20201031 and later QTS 4.5.1.1456 build 20201015 and later QTS 4.4.3.1354 build 20200702 and later
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is the vulnerability ID for this command injection vulnerability?
The vulnerability ID for this command injection vulnerability is CVE-2019-7198.
What is the severity of CVE-2019-7198?
The severity of CVE-2019-7198 is critical.
Which versions of QTS and QuTS hero are affected by CVE-2019-7198?
The affected versions of QTS and QuTS hero are QuTS hero up to h4.5.1.1472 and QTS up to 4.4.3.1354.
How can an attacker exploit CVE-2019-7198?
An attacker can exploit CVE-2019-7198 by executing arbitrary commands in a compromised application.
Has QNAP fixed CVE-2019-7198?
Yes, QNAP has already fixed CVE-2019-7198 in the following versions: QuTS hero h4.5.1.1472 build 20201031 and later, QTS 4.5.1.1456 build 20201015 and later, QTS 4.4.3.1354 build 20201015 and later.