CVE Watch13 ago 2026

CVE-2018-19949

QNAP NAS File Station Command Injection Vulnerability

CVSS

9.8

Crítico

EPSS

24.4%

p98

KEV

SÍ

24 may 2022

Exploit Today

0-100

Publicado: 28 oct 2020 · Última mod.: 13 ago 2026 · CWE-20 · CWE-77 · CWE-78

EPSS · 30d

24.4%EPSS · 30 días24.4%

2026-08-022026-08-31

Ficha del catálogo KEV

Producto

QNAP / Network Attached Storage (NAS)

Vulnerabilidad

QNAP NAS File Station Command Injection Vulnerability

Añadido a KEV

24 may 2022

Remediar antes de

14 jun 2022

Uso conocido en ransomware

Sí

Descripción resumida

A command injection vulnerability affecting QNAP NAS File Station could allow remote attackers to run commands.

Acción requerida

Apply updates per vendor instructions.

Notas

https://nvd.nist.gov/vuln/detail/CVE-2018-19949

Descripción técnica

If exploited, this command injection vulnerability could allow remote attackers to run arbitrary commands. QNAP has already fixed the issue in the following QTS versions. QTS 4.4.2.1231 on build 20200302; QTS 4.4.1.1201 on build 20200130; QTS 4.3.6.1218 on build 20200214; QTS 4.3.4.1190 on build 20200107; QTS 4.3.3.1161 on build 20200109; QTS 4.2.6 on build 20200109.

Referencias oficiales

CVEs relacionados

CVECVSSEPSSKEVRExplotTítuloVis.

CVE-2026-826929.9 CRÍ

—

——0A vulnerability was found in D-Link DNS-340L and DNS-345 up to 20260717. This affects an unknown part of the file /cgi-bin/iscsi_mgr.cgi. Performing a manipulation of the argument alias/username/password/volume_location results in os command injection. It is possible to initiate the attack remotely. The exploit has been made public and could be used.3h CVE-2026-826919.1 CRÍ

—

——0A vulnerability has been found in D-Link DNS-320L, DNS-327L, DNS-340L and DNS-345 up to 20260717. Affected by this issue is some unknown functionality of the file /cgi-bin/usb_device.cgi of the component CGI Handler. Such manipulation of the argument f_ups_ip leads to os command injection. The attack may be performed from remote. The exploit has been disclosed to the public and may be used.4h CVE-2026-826909.1 CRÍ

—

——0A flaw has been found in D-Link DNS-327L and DNS-340L up to 20260717. Affected by this vulnerability is an unknown functionality of the file /cgi-bin/ve_mgr.cgi. This manipulation of the argument f_dev causes os command injection. The attack is possible to be carried out remotely. The exploit has been published and may be used.4h CVE-2026-826899.9 CRÍ

—

——0A vulnerability was detected in D-Link DNS-320L, DNS-327L, DNS-340L and DNS-345 up to 20260717. Affected is an unknown function of the file /cgi-bin/isomount_mgr.cgi of the component ISO Image Handler. The manipulation of the argument upIsoRootPath results in os command injection. The attack can be executed remotely. The exploit is now public and may be used.4h CVE-2026-826889.1 CRÍ

—

——0A security vulnerability has been detected in D-Link DNS-340L and DNS-345 1.01B04/1.03B06/1.04.B02/1.05b04. This impacts an unknown function of the file /cgi-bin/virtual_vol.cgi of the component Virtual Volume Handler. The manipulation of the argument f_sharename/f_target/f_name leads to os command injection. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used.5h CVE-2026-826784.7 MED

—

——0A vulnerability was identified in diem-project diem up to 5.1.3. The affected element is the function executeCommand of the file dmAdminPlugin/modules/dmConsole/actions/actions.class.php of the component Administrative Console. Such manipulation of the argument dm_command leads to os command injection. The attack can be launched remotely. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.5h