Read the docs
TI-2018-14137 Aliases CVE-2018-19949GHSA-h9cw-v634-8jcw

Improper input validation in QNAP QTS

Priority CRITICAL 100Exploited in the wildCWE-20Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-77.

Summary

If exploited, this command injection vulnerability could allow remote attackers to run arbitrary commands. QNAP has already fixed the issue in the following QTS versions. QTS 4.4.2.1231 on build 20200302; QTS 4.4.1.1201 on build 20200130; QTS 4.3.6.1218 on build 20200214; QTS 4.3.4.1190 on build 20200107; QTS 4.3.3.1161 on build 20200109; QTS 4.2.6 on build 20200109.

Why it matters now

Exploitation Active In CISA KEV since 2022-05-24CISA due date 2022-06-14Known ransomware use
EPSS 0.3016 98th percentileScored 2026-11-07
Fix Fixed QTS (QNAP Systems Inc.): 4.4.2.1231, 4.4.1.1201, 4.3.6.1218 +3

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Active
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
QNAPQTSbefore 4.4.2.12314.4.2.1231Patch availableCNA
QNAPQTSbefore 4.4.1.12014.4.1.1201Patch availableCNA
QNAPQTSbefore 4.3.6.12184.3.6.1218Patch availableCNA
QNAPQTSbefore 4.3.4.11904.3.4.1190Patch availableCNA
QNAPQTSbefore 4.3.3.1161; before 4.2.64.3.3.1161, 4.2.6Patch availableCNA
  • QTS VendorQNAP Affected before 4.4.2.1231 Fixed in 4.4.2.1231 Patch available CNA
  • QTS VendorQNAP Affected before 4.4.1.1201 Fixed in 4.4.1.1201 Patch available CNA
  • QTS VendorQNAP Affected before 4.3.6.1218 Fixed in 4.3.6.1218 Patch available CNA
  • QTS VendorQNAP Affected before 4.3.4.1190 Fixed in 4.3.4.1190 Patch available CNA
  • QTS VendorQNAP Affected before 4.3.3.1161; before 4.2.6 Fixed in 4.3.3.1161, 4.2.6 Patch available CNA

CPE configurations NVD · 7

CPEVersionsRoleVendor
cpe:2.3:o:qnap:qts:*:*:*:*:*:*:*:*before 4.2.6; 4.3.1.0013 to before 4.3.3.1161; 4.3.4 to before 4.3.4.1190; 4.3.6 to before 4.3.6.1218; 4.4.0 to before 4.4.1.1201; 4.4.2 to before 4.4.2.1231VulnerableQNAP
cpe:2.3:o:qnap:qts:4.2.6:-:*:*:*:*:*:*4.2.6VulnerableQNAP
cpe:2.3:o:qnap:qts:4.2.6:build_20170517:*:*:*:*:*:*4.2.6 build_20170517VulnerableQNAP
cpe:2.3:o:qnap:qts:4.2.6:build_20190322:*:*:*:*:*:*4.2.6 build_20190322VulnerableQNAP
cpe:2.3:o:qnap:qts:4.2.6:build_20190730:*:*:*:*:*:*4.2.6 build_20190730VulnerableQNAP
cpe:2.3:o:qnap:qts:4.2.6:build_20190921:*:*:*:*:*:*4.2.6 build_20190921VulnerableQNAP
cpe:2.3:o:qnap:qts:4.2.6:build_20191107:*:*:*:*:*:*4.2.6 build_20191107VulnerableQNAP
  • cpe:2.3:o:qnap:qts:*:*:*:*:*:*:*:* Versions before 4.2.6; 4.3.1.0013 to before 4.3.3.1161; 4.3.4 to before 4.3.4.1190; 4.3.6 to before 4.3.6.1218; 4.4.0 to before 4.4.1.1201; 4.4.2 to before 4.4.2.1231 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.2.6:-:*:*:*:*:*:* Versions 4.2.6 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.2.6:build_20170517:*:*:*:*:*:* Versions 4.2.6 build_20170517 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.2.6:build_20190322:*:*:*:*:*:* Versions 4.2.6 build_20190322 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.2.6:build_20190730:*:*:*:*:*:* Versions 4.2.6 build_20190730 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.2.6:build_20190921:*:*:*:*:*:* Versions 4.2.6 build_20190921 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.2.6:build_20191107:*:*:*:*:*:* Versions 4.2.6 build_20191107 Vulnerable ·QNAP

Remediation

  • Fix · CNA QTS (QNAP Systems Inc.) Fixed in 4.4.2.1231
  • Fix · CNA QTS (QNAP Systems Inc.) Fixed in 4.4.1.1201
  • Fix · CNA QTS (QNAP Systems Inc.) Fixed in 4.3.6.1218
  • Fix · CNA QTS (QNAP Systems Inc.) Fixed in 4.3.4.1190
  • Fix · CNA QTS (QNAP Systems Inc.) Fixed in 4.3.3.1161, 4.2.6

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    QNAP Systems QTS 4.2.6, 4.3.3.1161 and 4 more versions

    2 records Highest priority Priority CRITICAL 2 CRITICAL

    Other records, highest priority first

    • TI-2018-14141 Cross-site scripting in QNAP QTSPriority CRITICAL 86
    Show all 2 records →

Timeline

  1. 2022-05-24 Added to CISA KEV
  2. 2026-10-02 Threatist record created from CVE-2018-19949
  3. 2026-10-03 Alias added: GHSA-h9cw-v634-8jcw

References

Advisory 1

  • TI-2020-02221 Command Injection Vulnerability in QTS and QuTS hero KEVCVSS 3.1CRITICAL 9.8
  • TI-2019-05101 Improper input validation in QNAP NAS devices KEVCVSS 3.1CRITICAL 9.8
  • TI-2014-05975 GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed… KEVCVSS 3.1CRITICAL 9.8
  • TI-2014-05157 GNU Bash through 4.3 processes trailing strings after function definitions in the values… KEVCVSS 3.1CRITICAL 9.8
  • TI-2018-14131 Cross-site scripting in QNAP QTS KEVCVSS 3.1HIGH 8.0
  • TI-2018-14141 Cross-site scripting in QNAP QTS KEVCVSS 3.1MEDIUM 6.1
See all 282 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences