Actively exploited · Published May 14, 2019 · Assigned by mitre
CVE-2018-14839
Critical 9.8 Exploited
In plain English
A critical-severity OS command injection in N1A1 NAS from LG. Attackers are actively exploiting it in the wild (listed by CISA on March 25, 2022). The chance it is exploited in the next 30 days is estimated at 89.2% (higher than 99.8% of all known vulnerabilities). Apply updates per vendor instructions.
Severity (CVSS 3.1)9.8Critical
Exploit odds (30 days)89.2%top 0.2% of all CVEs
Exploited in the wildYesCISA KEV since Mar 25, 2022
Attack toolingNoneno public tooling known
CISA guidance
Apply updates per vendor instructions.
Federal agencies must remediate by Apr 15, 2022.
Official description
LG N1A1 NAS 3718.510 is affected by: Remote Command Execution. The impact is: execute arbitrary code (remote). The attack vector is: HTTP POST with parameters.
Affected products (as reported)
Weakness: CWE-78 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H