CVE-2018-19949Critical· 9.8▾ Hadal⚠ Exploited in the wildPoC availableIf exploited, this command injection vulnerability could allow remote attackers to run arbitrary commands. QNAP has already fixed the issue in the following QTS versions. QTS 4.4.2.1231 on build 20200302; QTS 4.4.1.1201 on build 20200130…
▾ Hadal zone — Critical and actively exploited (CISA KEV / 0day)
impact 53.9 · likelihood 6 · exploitation 25 · ransomware 5
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Aug 13.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Federal remediation due Jun 14, 2022
24%
Exploit / PoC code exists
Last analysed / modified upstream
24% → 30%
Added to the CISA catalog on May 24, 2022. Federal remediation due Jun 14, 2022. View catalog ↗
If exploited, this command injection vulnerability could allow remote attackers to run arbitrary commands. QNAP has already fixed the issue in the following QTS versions. QTS 4.4.2.1231 on build 20200302; QTS 4.4.1.1201 on build 20200130; QTS 4.3.6.1218 on build 20200214; QTS 4.3.4.1190 on build 20200107; QTS 4.3.3.1161 on build 20200109; QTS 4.2.6 on build 20200109.
qts < 4.2.6qts >= 4.3.1.0013, < 4.3.3.1161qts >= 4.3.4, < 4.3.4.1190qts >= 4.3.6, < 4.3.6.1218qts >= 4.4.0, < 4.4.1.1201qts >= 4.4.2, < 4.4.2.1231qts = 4.2.6Upgrade past the affected range:
qts 4.4.2.1231Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2018-19953Medium· 6.1If exploited, this cross-site scripting vulnerability could allow remote attackers to inject malicious code
CVE-2018-19943High· 8.0If exploited, this cross-site scripting vulnerability could allow remote attackers to inject malicious code
CVE-2025-30264High· 8.8A command injection vulnerability has been reported to affect several QNAP operating system versions
CVE-2026-41539Medium· 6.3QTS, QuTS hero
CVE-2024-38639Medium· 4.8An improper authentication vulnerability has been reported to affect product
CVE-2022-29499Critical· 9.8The Service Appliance component in Mitel MiVoice Connect through 19.2 SP3 allows remote code execution because of incorrect data validation