CVE-2018-19949VulnerabilityPublished 05/24/2022Updated 10/24/2026

CVE-2018-19949: QNAP NAS File Station Command Injection Vulnerability

Affects QNAP Network Attached Storage (NAS)Source CISA KEV

Severity

High

No CVSS score published yet

Exploitation: Actively exploited – in CISA KEV since 05/24/2022
KEV deadline: 06/14/2022
Ransomware: Used in ransomware campaigns
EPSS: 30.2% chance of exploitation in 30 days – higher than 98% of CVEs

What to do

CISA required action

Apply updates per vendor instructions.

nvd.nist.gov/vuln/detail/CVE-2018-19949 (opens in a new tab)

Description

CVE-2018-19949 is a command injection vulnerability in QNAP NAS File Station that allows remote attackers to execute arbitrary commands. This vulnerability has been exploited in the wild and is known to have been used in ransomware campaigns. No specific affected versions or patch information is provided in the available data.

Summary

This vulnerability in QNAP Network Attached Storage (NAS) File Station enables remote attackers to inject and execute arbitrary commands on the affected system. The issue is classified under CWE-20 (Improper Input Validation), CWE-77 (Improper Neutralization of Special Elements used in a Command), and CWE-78 (Improper Neutralization of Special Elements used in an OS Command). Exploitation of this flaw has been observed in the wild, including use in ransomware attacks targeting vulnerable devices.

Impact

Successful exploitation allows remote attackers to execute arbitrary commands on the NAS device, potentially leading to full system compromise. This can result in data loss, unauthorized access, and disruption of services. The vulnerability has been actively exploited, increasing the risk to affected users.

Mitigation

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should monitor QNAP's security advisories and apply any recommended mitigations. Given the active exploitation, consider restricting network access to the File Station service and implementing additional network-level protections.

CVE-2018-19949: QNAP NAS File Station Command Injection Vulnerability

What to do

Description

Summary

Impact

Mitigation

Weaknesses

References

What to do

Description

AnalysisAI-generated, updated 10/24/2026, 11:42:45 UTC

Weaknesses

References

Related threats