Read the docs
TI-2018-00679 Aliases CVE-2018-0730GHSA-2cm3-h7wr-fg9v

Command injection in QNAP NAS devices

Priority MEDIUM 46CWE-77Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-77.

Summary

This command injection vulnerability in File Station allows attackers to execute commands on the affected device. To fix the vulnerability, QNAP recommend updating QTS to their latest versions.

Why it matters now

EPSS 0.0196 80th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—QNAP NAS devicesQTS 4.4.1: before build 20190918, QTS 4.3.6: before build 20190328, QTS 4.3.4: before build 20190325, QTS 4.3.3: before build 20190325, QTS 4.2.6: before build 20190325—No fix listedCNA
  • QNAP NAS devices Vendor— Affected QTS 4.4.1: before build 20190918, QTS 4.3.6: before build 20190328, QTS 4.3.4: before build 20190325, QTS 4.3.3: before build 20190325, QTS 4.2.6: before build 20190325 Fixed in — No fix listed CNA

CPE configurations NVD · 25

CPEVersionsRoleVendor
cpe:2.3:o:qnap:qts:4.2.6:*:*:*:*:*:*:*4.2.6VulnerableQNAP
cpe:2.3:o:qnap:qts:4.3.3.0868:*:*:*:*:*:*:*4.3.3.0868VulnerableQNAP
cpe:2.3:o:qnap:qts:4.3.3.0998:*:*:*:*:*:*:*4.3.3.0998VulnerableQNAP
cpe:2.3:o:qnap:qts:4.3.4.0899:*:*:*:*:*:*:*4.3.4.0899VulnerableQNAP
cpe:2.3:o:qnap:qts:4.3.4.1029:*:*:*:*:*:*:*4.3.4.1029VulnerableQNAP
cpe:2.3:o:qnap:qts:4.3.6.0895:*:*:*:*:*:*:*4.3.6.0895VulnerableQNAP
cpe:2.3:o:qnap:qts:4.3.6.0907:*:*:*:*:*:*:*4.3.6.0907VulnerableQNAP
cpe:2.3:o:qnap:qts:4.3.6.0923:*:*:*:*:*:*:*4.3.6.0923VulnerableQNAP
cpe:2.3:o:qnap:qts:4.3.6.0944:*:*:*:*:*:*:*4.3.6.0944VulnerableQNAP
cpe:2.3:o:qnap:qts:4.3.6.0959:*:*:*:*:*:*:*4.3.6.0959VulnerableQNAP
  • cpe:2.3:o:qnap:qts:4.2.6:*:*:*:*:*:*:* Versions 4.2.6 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.3.0868:*:*:*:*:*:*:* Versions 4.3.3.0868 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.3.0998:*:*:*:*:*:*:* Versions 4.3.3.0998 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.4.0899:*:*:*:*:*:*:* Versions 4.3.4.0899 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.4.1029:*:*:*:*:*:*:* Versions 4.3.4.1029 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.6.0895:*:*:*:*:*:*:* Versions 4.3.6.0895 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.6.0907:*:*:*:*:*:*:* Versions 4.3.6.0907 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.6.0923:*:*:*:*:*:*:* Versions 4.3.6.0923 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.6.0944:*:*:*:*:*:*:* Versions 4.3.6.0944 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.6.0959:*:*:*:*:*:*:* Versions 4.3.6.0959 Vulnerable ·QNAP
Show 15 more CPE
CPEVersionsRoleVendor
cpe:2.3:o:qnap:qts:4.3.6.0979:*:*:*:*:*:*:*4.3.6.0979VulnerableQNAP
cpe:2.3:o:qnap:qts:4.3.6.0993:*:*:*:*:*:*:*4.3.6.0993VulnerableQNAP
cpe:2.3:o:qnap:qts:4.3.6.1013:*:*:*:*:*:*:*4.3.6.1013VulnerableQNAP
cpe:2.3:o:qnap:qts:4.3.6.1033:*:*:*:*:*:*:*4.3.6.1033VulnerableQNAP
cpe:2.3:o:qnap:qts:4.4.1.0948:beta:*:*:*:*:*:*4.4.1.0948 betaVulnerableQNAP
cpe:2.3:o:qnap:qts:4.4.1.0949:beta:*:*:*:*:*:*4.4.1.0949 betaVulnerableQNAP
cpe:2.3:o:qnap:qts:4.4.1.0978:beta_2:*:*:*:*:*:*4.4.1.0978 beta_2VulnerableQNAP
cpe:2.3:o:qnap:qts:4.4.1.0998:beta_3:*:*:*:*:*:*4.4.1.0998 beta_3VulnerableQNAP
cpe:2.3:o:qnap:qts:4.4.1.0999:beta_3:*:*:*:*:*:*4.4.1.0999 beta_3VulnerableQNAP
cpe:2.3:o:qnap:qts:4.4.1.1031:beta_4:*:*:*:*:*:*4.4.1.1031 beta_4VulnerableQNAP
cpe:2.3:o:qnap:qts:4.4.1.1033:beta_4:*:*:*:*:*:*4.4.1.1033 beta_4VulnerableQNAP
cpe:2.3:o:qnap:qts:4.4.1.1064:*:*:*:*:*:*:*4.4.1.1064VulnerableQNAP
cpe:2.3:o:qnap:qts:4.4.1.1081:*:*:*:*:*:*:*4.4.1.1081VulnerableQNAP
cpe:2.3:o:qnap:qts:4.4.1.1086:*:*:*:*:*:*:*4.4.1.1086VulnerableQNAP
cpe:2.3:o:qnap:qts:4.4.1.1101:*:*:*:*:*:*:*4.4.1.1101VulnerableQNAP
  • cpe:2.3:o:qnap:qts:4.3.6.0979:*:*:*:*:*:*:* Versions 4.3.6.0979 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.6.0993:*:*:*:*:*:*:* Versions 4.3.6.0993 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.6.1013:*:*:*:*:*:*:* Versions 4.3.6.1013 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.6.1033:*:*:*:*:*:*:* Versions 4.3.6.1033 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.4.1.0948:beta:*:*:*:*:*:* Versions 4.4.1.0948 beta Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.4.1.0949:beta:*:*:*:*:*:* Versions 4.4.1.0949 beta Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.4.1.0978:beta_2:*:*:*:*:*:* Versions 4.4.1.0978 beta_2 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.4.1.0998:beta_3:*:*:*:*:*:* Versions 4.4.1.0998 beta_3 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.4.1.0999:beta_3:*:*:*:*:*:* Versions 4.4.1.0999 beta_3 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.4.1.1031:beta_4:*:*:*:*:*:* Versions 4.4.1.1031 beta_4 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.4.1.1033:beta_4:*:*:*:*:*:* Versions 4.4.1.1033 beta_4 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.4.1.1064:*:*:*:*:*:*:* Versions 4.4.1.1064 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.4.1.1081:*:*:*:*:*:*:* Versions 4.4.1.1081 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.4.1.1086:*:*:*:*:*:*:* Versions 4.4.1.1086 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.4.1.1101:*:*:*:*:*:*:* Versions 4.4.1.1101 Vulnerable ·QNAP

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2018-0730
  2. 2026-10-03 Alias added: GHSA-2cm3-h7wr-fg9v

References

Advisory 1

  • TI-2020-02221 Command Injection Vulnerability in QTS and QuTS hero KEVCVSS 3.1CRITICAL 9.8
  • TI-2019-05101 Improper input validation in QNAP NAS devices KEVCVSS 3.1CRITICAL 9.8
  • TI-2018-14137 Improper input validation in QNAP QTS KEVCVSS 3.1CRITICAL 9.8
  • TI-2014-05975 GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed… KEVCVSS 3.1CRITICAL 9.8
  • TI-2014-05157 GNU Bash through 4.3 processes trailing strings after function definitions in the values… KEVCVSS 3.1CRITICAL 9.8
  • TI-2018-14131 Cross-site scripting in QNAP QTS KEVCVSS 3.1HIGH 8.0
See all 282 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences