CISA KEV · Known exploitedCritical

CVE-2018-19949

QNAP Network Attached Storage (NAS)

If exploited, this command injection vulnerability could allow remote attackers to run arbitrary commands. QNAP has already fixed the issue in the following QTS versions. QTS 4.4.2.1231 on build 20200302; QTS 4.4.1.1201 on build 20200130; QTS 4.3.6.1218 on build 20200214; QTS 4.3.4.1190 on build 20200107; QTS 4.3.3.1161 on build 20200109; QTS 4.2.6 on build 20200109.

CVSS: 9.8
EPSS: 24.4%
CISA KEV: Listed
Published: 2020.10.29

PRIORITY ASSESSMENT

Immediate review

CISA has listed this vulnerability in the Known Exploited Vulnerabilities catalog.

Known exploitationConfirmed by CISA KEV

Exploit probability24.4%

Technical severityCVSS 9.8

Vulnerability overview

Affected product and versions

Product: QNAP Network Attached Storage (NAS)
Affected versions: unspecified, < 4.2.6, >= 4.3.1.0013 < 4.3.3.1161, >= 4.3.4 < 4.3.4.1190, >= 4.3.6 < 4.3.6.1218, >= 4.4.0 < 4.4.1.1201, >= 4.4.2 < 4.4.2.1231, 4.2.6
Fixed versions: 4.2.6, 4.3.3.1161, 4.3.4.1190, 4.3.6.1218, 4.4.1.1201, 4.4.2.1231

Recommended response sequence

Confirm exposure before applying a vendor-supported change.

Full remediation guide

CISA required action

Apply updates per vendor instructions.

Due date: 2022.06.14

1
Identify
Confirm that QNAP Network Attached Storage (NAS) and an affected version are present.
2
Prioritize
Combine exploitation signals with asset exposure and business criticality.
3
Remediate
Follow the vendor advisory or supported update path and preserve rollback options.
4
Verify
Recheck the version, service health, access paths, and relevant logs.

Technical data

CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE: CWE-20, CWE-77, CWE-78
KEV added: 2022.05.24
Ransomware use: 확인됨