CVE WatchOct 2, 2026

CVE-2018-19949

QNAP NAS File Station Command Injection Vulnerability

CVSS

9.8

Critical

EPSS

28.6%

p98

KEV

YES

May 24, 2022

Exploit Today

0-100

Published: Oct 28, 2020 · Last modified: Oct 2, 2026 · CWE-20 · CWE-77 · CWE-78

EPSS · 30d

24.4%EPSS · 30 days28.6%

2026-09-162026-10-14

KEV catalog record

Product

QNAP / Network Attached Storage (NAS)

Vulnerability

QNAP NAS File Station Command Injection Vulnerability

Added to KEV

May 24, 2022

Remediate by

Jun 14, 2022

Known ransomware use

Yes

Summary description

A command injection vulnerability affecting QNAP NAS File Station could allow remote attackers to run commands.

Required action

Apply updates per vendor instructions.

Notes

https://nvd.nist.gov/vuln/detail/CVE-2018-19949

Technical description

If exploited, this command injection vulnerability could allow remote attackers to run arbitrary commands. QNAP has already fixed the issue in the following QTS versions. QTS 4.4.2.1231 on build 20200302; QTS 4.4.1.1201 on build 20200130; QTS 4.3.6.1218 on build 20200214; QTS 4.3.4.1190 on build 20200107; QTS 4.3.3.1161 on build 20200109; QTS 4.2.6 on build 20200109.

Official references

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2026-798377.3 HIG

—

———A vulnerability in HPE NonStop SQL/MX UDR SERVER may allow a crafted message to cause process termination, service disruption or memory corruption, resulting in undefined behavior.5h CVE-2026-798366.4 MED

—

———A vulnerability HPE NonStop SQL/MX Run-Time Statistics may allow an attacker to cause memory corruption and null pointer dereference, potentially leading to process crash, DoS or information disclosure.6h CVE-2026-798352.8 LOW

—

———A crafted input message can cause a buffer overflow in HPE Nonstop KMS Server.6h CVE-2026-798347.4 HIG

—

———A security vulnerability in HPE NonStop SQL/MX SQLCAT may allow an unauthenticated user to perform unauthorized command execution.6h CVE-2026-798298.2 HIG

—

———A security vulnerability in HPE NonStop HTTP WEBSERVER can cause memory corruption which may result in a system halt.8h CVE-2026-47786—

—

———An OS command injection vulnerability has been reported to affect HybridDesk Station. If exploited, the vulnerability could allow remote attackers to execute arbitrary commands. We have already fixed the vulnerability in the following version: HybridDesk Station 4.2.23 and later HybridDesk Station 4.3.4 and later8h