Read the docs
TI-2018-14138 Aliases CVE-2018-19950GHSA-rc96-pxf6-73c4

Command injection in QNAP Music Station

Priority MEDIUM 46CWE-77Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-77.

Summary

If exploited, this command injection vulnerability could allow remote attackers to execute arbitrary commands. This issue affects: QNAP Systems Inc. Music Station versions prior to 5.1.13; versions prior to 5.2.9; versions prior to 5.3.11.

Why it matters now

EPSS 0.02063 81st percentileScored 2026-11-07
Fix Fixed Music Station (QNAP Systems Inc.): 5.1.13, 5.2.9, 5.3.11

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
QNAPMusic Stationbefore 5.1.13; before 5.2.9; before 5.3.115.1.13, 5.2.9, 5.3.11Patch availableCNA
  • Music Station VendorQNAP Affected before 5.1.13; before 5.2.9; before 5.3.11 Fixed in 5.1.13, 5.2.9, 5.3.11 Patch available CNA

CPE configurations NVD · 7

CPEVersionsRoleVendor
cpe:2.3:a:qnap:music_station:*:*:*:*:*:*:*:*5.3.0 to before 5.3.11VulnerableQNAP
cpe:2.3:o:qnap:qts:4.4.3:*:*:*:*:*:*:*4.4.3Running onQNAP
cpe:2.3:a:qnap:music_station:*:*:*:*:*:*:*:*before 5.1.13VulnerableQNAP
cpe:2.3:o:qnap:qts:4.3.4:*:*:*:*:*:*:*4.3.4Running onQNAP
cpe:2.3:a:qnap:music_station:*:*:*:*:*:*:*:*5.2.0 to before 5.2.9VulnerableQNAP
cpe:2.3:o:qnap:qts:4.3.6:*:*:*:*:*:*:*4.3.6Running onQNAP
cpe:2.3:o:qnap:qts:4.3.3:*:*:*:*:*:*:*4.3.3Running onQNAP
  • cpe:2.3:a:qnap:music_station:*:*:*:*:*:*:*:* Versions 5.3.0 to before 5.3.11 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.4.3:*:*:*:*:*:*:* Versions 4.4.3 Running on ·QNAP
  • cpe:2.3:a:qnap:music_station:*:*:*:*:*:*:*:* Versions before 5.1.13 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.4:*:*:*:*:*:*:* Versions 4.3.4 Running on ·QNAP
  • cpe:2.3:a:qnap:music_station:*:*:*:*:*:*:*:* Versions 5.2.0 to before 5.2.9 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.6:*:*:*:*:*:*:* Versions 4.3.6 Running on ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.3:*:*:*:*:*:*:* Versions 4.3.3 Running on ·QNAP

Remediation

  • Fix · CNA Music Station (QNAP Systems Inc.) Fixed in 5.1.13, 5.2.9, 5.3.11

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    QNAP Systems Music Station 5.1.13, 5.2.9, 5.3.11

    3 records Highest priority Priority MEDIUM 1 MEDIUM, 2 LOW

    Other records, highest priority first

    • TI-2018-14140 Improper input validation in QNAP Music StationPriority LOW 35
    • TI-2018-14139 Cross-site scripting in QNAP Music StationPriority LOW 29
    Show all 3 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2018-19950
  2. 2026-10-03 Alias added: GHSA-rc96-pxf6-73c4

References

Advisory 1

  • TI-2020-18517 Improper Access Control Vulnerability in Music Station CVSS 3.1HIGH 8.8
  • TI-2018-00678 Command injection in QNAP NAS devices CVSS 3.1CRITICAL 9.8
  • TI-2018-00671 Command injection in QNAP Music Station CVSS 3.0CRITICAL 9.8
  • TI-2017-09711 QNAP discovered a number of command injection vulnerabilities found in Music Station… CVSS 3.0CRITICAL 9.8
  • TI-2023-24086 Improper authentication in QNAP Music Station CVSS 3.1HIGH 8.8
  • TI-2023-20443 Path traversal in QNAP Music Station CVSS 3.1HIGH 7.5
See all 12 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences