Actively exploited · Published Oct 28, 2020 · Assigned by qnap

CVE-2018-19949

Critical 9.8 Exploited Ransomware

In plain English

A critical-severity improper input validation in QTS from QNAP Systems Inc.. Attackers are actively exploiting it in the wild (listed by CISA on May 24, 2022). It has been used in ransomware campaigns. The chance it is exploited in the next 30 days is estimated at 30.2% (higher than 98% of all known vulnerabilities). Apply updates per vendor instructions.

Severity (CVSS 3.1)9.8Critical

Exploit odds (30 days)30.2%top 1.8% of all CVEs

Exploited in the wildYesCISA KEV since May 24, 2022

Attack toolingNoneno public tooling known

CISA guidance

Apply updates per vendor instructions.

Federal agencies must remediate by Jun 14, 2022.

Official description

If exploited, this command injection vulnerability could allow remote attackers to run arbitrary commands. QNAP has already fixed the issue in the following QTS versions. QTS 4.4.2.1231 on build 20200302; QTS 4.4.1.1201 on build 20200130; QTS 4.3.6.1218 on build 20200214; QTS 4.3.4.1190 on build 20200107; QTS 4.3.3.1161 on build 20200109; QTS 4.2.6 on build 20200109.

Affected products (as reported)

Vendor	Product	Versions
QNAP Systems Inc.	QTS	unspecified – before 4.4.2.1231
QNAP Systems Inc.	QTS	unspecified – before 4.4.1.1201
QNAP Systems Inc.	QTS	unspecified – before 4.3.6.1218
QNAP Systems Inc.	QTS	unspecified – before 4.3.4.1190
QNAP Systems Inc.	QTS	unspecified – before 4.3.3.1161unspecified – before 4.2.6

Weakness: CWE-20, CWE-77, CWE-78 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

https://www.qnap.com/zh-tw/security-advisory/qsa-20-01 x_refsource_MISC
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-19949 government-resource