CVE Watch2 oct 2026

CVE-2018-19949

QNAP NAS File Station Command Injection Vulnerability

CVSS

9.8

Crítico

EPSS

28.6%

p98

KEV

SÍ

24 may 2022

Exploit Today

0-100

Publicado: 28 oct 2020 · Última mod.: 2 oct 2026 · CWE-20 · CWE-77 · CWE-78

EPSS · 30d

24.4%EPSS · 30 días28.6%

2026-09-162026-10-14

Ficha del catálogo KEV

Producto

QNAP / Network Attached Storage (NAS)

Vulnerabilidad

QNAP NAS File Station Command Injection Vulnerability

Añadido a KEV

24 may 2022

Remediar antes de

14 jun 2022

Uso conocido en ransomware

Sí

Descripción resumida

A command injection vulnerability affecting QNAP NAS File Station could allow remote attackers to run commands.

Acción requerida

Apply updates per vendor instructions.

Notas

https://nvd.nist.gov/vuln/detail/CVE-2018-19949

Descripción técnica

If exploited, this command injection vulnerability could allow remote attackers to run arbitrary commands. QNAP has already fixed the issue in the following QTS versions. QTS 4.4.2.1231 on build 20200302; QTS 4.4.1.1201 on build 20200130; QTS 4.3.6.1218 on build 20200214; QTS 4.3.4.1190 on build 20200107; QTS 4.3.3.1161 on build 20200109; QTS 4.2.6 on build 20200109.

Referencias oficiales

CVEs relacionados

CVECVSSEPSSKEVRExplotTítuloVis.

CVE-2026-798377.3 ALT

—

———A vulnerability in HPE NonStop SQL/MX UDR SERVER may allow a crafted message to cause process termination, service disruption or memory corruption, resulting in undefined behavior.5h CVE-2026-798366.4 MED

—

———A vulnerability HPE NonStop SQL/MX Run-Time Statistics may allow an attacker to cause memory corruption and null pointer dereference, potentially leading to process crash, DoS or information disclosure.6h CVE-2026-798352.8 BAJ

—

———A crafted input message can cause a buffer overflow in HPE Nonstop KMS Server.6h CVE-2026-798347.4 ALT

—

———A security vulnerability in HPE NonStop SQL/MX SQLCAT may allow an unauthenticated user to perform unauthorized command execution.6h CVE-2026-798298.2 ALT

—

———A security vulnerability in HPE NonStop HTTP WEBSERVER can cause memory corruption which may result in a system halt.8h CVE-2026-47786—

—

———An OS command injection vulnerability has been reported to affect HybridDesk Station. If exploited, the vulnerability could allow remote attackers to execute arbitrary commands. We have already fixed the vulnerability in the following version: HybridDesk Station 4.2.23 and later HybridDesk Station 4.3.4 and later8h