{"id":"CVE-2018-19949","published":"2020-10-28T18:15:12Z","modified":"2026-10-02T04:17:58Z","title":"QNAP NAS File Station Command Injection Vulnerability","vendor":"QNAP","product":"Network Attached Storage (NAS)","tier":"core","eol":null,"description":{"text":"If exploited, this command injection vulnerability could allow remote attackers to run arbitrary commands. QNAP has already fixed the issue in the following QTS versions. QTS 4.4.2.1231 on build 20200302; QTS 4.4.1.1201 on build 20200130; QTS 4.3.6.1218 on build 20200214; QTS 4.3.4.1190 on build 20200107; QTS 4.3.3.1161 on build 20200109; QTS 4.2.6 on build 20200109.","provenance":"source","from":"NVD"},"summary":{"text":"A command injection flaw in the File Station component of QNAP Network Attached Storage (NAS) devices running QTS allows arbitrary operating system commands to be executed when input is not properly neutralised. Per the vector, an attacker can exploit it remotely over the network with low complexity and no privileges or user interaction required, which would give them high impact to confidentiality, integrity and availability.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T08:31:33Z"},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.3016,"percentile":0.98211,"date":"2026-10-28","provenance":"source"},"kev":{"dateAdded":"2022-05-24","dueDate":"2022-06-14","ransomware":true,"requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2018-19949","provenance":"source"},"vulncheckKev":{"dateAdded":"2020-06-05","exploitedFirstSeen":"2020-06-05","ransomware":true,"evidence":[{"url":"https://www.bleepingcomputer.com/news/security/ongoing-ech0raix-ransomware-campaign-targets-qnap-nas-devices/","date":"2020-06-05"},{"url":"https://cybersecurityworks.com/howdymanage/uploads/file/ransomware-_-2022-spotlight-report_compressed.pdf","date":"2022-01-26"},{"url":"https://cybersecurityworks.com/howdymanage/uploads/file/RansomwareUpdate%20Report%202022%20Q1.pdf","date":"2022-04-12"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2022-05-24"}],"evidenceTotal":4,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"},{"name":"Actively_Exploited_Kev | Oct 18, 2026","url":"https://otx.alienvault.com/pulse/6ad38c22e1848f8189d1c121","created":"2026-10-17"}],"provenance":"machine"},"cwes":[{"id":"CWE-77","name":"Improper Neutralization of Special Elements used in a Command"},{"id":"CWE-20","name":"Improper Input Validation"},{"id":"CWE-78","name":"Improper Neutralization of Special Elements used in an OS Command"}],"references":[{"url":"https://www.qnap.com/zh-tw/security-advisory/qsa-20-01","tags":["Vendor Advisory"]},{"url":"https://www.qnap.com/zh-tw/security-advisory/qsa-20-01","tags":["Vendor Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-19949","tags":["US Government Resource"]}],"techniques":[{"id":"T1190","name":"Exploit Public-Facing Application","tactics":["initial-access"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: remote unauthenticated input reaches command execution","mappingType":"exploitation_technique","evidence":[{"from":"description","quote":"this command injection vulnerability could allow remote attackers to run arbitrary commands","start":14,"end":105}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"},{"id":"T1059","name":"Command and Scripting Interpreter","tactics":["execution"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: arbitrary command execution is the direct impact","mappingType":"primary_impact","evidence":[{"from":"description","quote":"could allow remote attackers to run arbitrary commands","start":51,"end":105}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"}],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2018-11620","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2018-11620","exploited":true,"exploitedSince":"2022-05-24","provenance":"source"},"exploits":[],"exploitSources":null,"exploitRefs":[],"flow":[{"stage":"exploitation","techniques":["T1190"],"provenance":"ai"},{"stage":"primary","techniques":["T1059"],"provenance":"ai"}],"timeline":[{"date":"2020-06-05","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://www.bleepingcomputer.com/news/security/ongoing-ech0raix-ransomware-campaign-targets-qnap-nas-devices/","provenance":"source"},{"date":"2020-10-28","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2018-19949","provenance":"source"},{"date":"2022-05-24","kind":"kev","label":"Added to CISA KEV (known ransomware use)","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2022-05-24","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2018-11620","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":573},"priority":{"score":74.5,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 2337 days ago"},{"name":"Known ransomware use","points":10.0,"detail":"CISA KEV and VulnCheck KEV: Known"},{"name":"EPSS percentile","points":19.64,"detail":"percentile 0.9821"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":0.0,"detail":"none found"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":6.86,"detail":"base score 9.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}