---
id: CVE-2018-19949
title: >-
  If exploited, this command injection vulnerability could allow remote
  attackers to run arbitrary commands
summary: >-
  If exploited, this command injection vulnerability could allow remote
  attackers to run arbitrary commands. QNAP has already fixed the issue in the
  following QTS versions. QTS 4.4.2.1231 on build 20200302; QTS 4.4.1.1201 on
  build 20200130…
severity: critical
cvss: 9.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-20
  - CWE-77
  - CWE-78
vendor: qnap
product: qts
affected:
  - qts < 4.2.6
  - 'qts >= 4.3.1.0013, < 4.3.3.1161'
  - 'qts >= 4.3.4, < 4.3.4.1190'
  - 'qts >= 4.3.6, < 4.3.6.1218'
  - 'qts >= 4.4.0, < 4.4.1.1201'
  - 'qts >= 4.4.2, < 4.4.2.1231'
  - qts = 4.2.6
patched:
  - qts 4.4.2.1231
published: '2020-10-28'
updated: '2026-10-02'
sourceUpdated: '2026-10-02T04:17:58.520'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2018-19949'
references:
  - url: 'https://www.qnap.com/zh-tw/security-advisory/qsa-20-01'
    label: security@qnapsecurity.com.tw
  - url: 'https://www.qnap.com/zh-tw/security-advisory/qsa-20-01'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: >-
      https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-19949
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
tags:
  - nvd
  - cve.org
  - in-the-wild
  - exploit-available
  - kev
exploited: true
exploitAvailable: true
ssvc:
  exploitation: active
  automatable: 'yes'
  technicalImpact: total
  timestamp: '2026-10-01T19:31:14.611633Z'
epss: 0.3016
epssPercentile: 0.98208
kev: true
kevDateAdded: '2022-05-24'
kevDueDate: '2022-06-14'
kevRansomware: true
ingestedAt: '2026-08-13T06:00:54.946Z'
---

## Overview

If exploited, this command injection vulnerability could allow remote attackers to run arbitrary commands. QNAP has already fixed the issue in the following QTS versions. QTS 4.4.2.1231 on build 20200302; QTS 4.4.1.1201 on build 20200130; QTS 4.3.6.1218 on build 20200214; QTS 4.3.4.1190 on build 20200107; QTS 4.3.3.1161 on build 20200109; QTS 4.2.6 on build 20200109.

## Affected

- `qts < 4.2.6`
- `qts >= 4.3.1.0013, < 4.3.3.1161`
- `qts >= 4.3.4, < 4.3.4.1190`
- `qts >= 4.3.6, < 4.3.6.1218`
- `qts >= 4.4.0, < 4.4.1.1201`
- `qts >= 4.4.2, < 4.4.2.1231`
- `qts = 4.2.6`

## Remediation

Upgrade past the affected range:

- `qts 4.4.2.1231`