Exploited· due 2022-06-146.1mediumMediumused in ransomware
CVE-2018-19953
Qnap Qts
If exploited, this cross-site scripting vulnerability could allow remote attackers to inject malicious code. QNAP has already fixed the issue in the following QTS versions. QTS 4.4.2.1231 on build 20200302; QTS 4.4.1.1201 on build 20200130; QTS 4.3.6.1218 on build 20200214; QTS 4.3.4.1190 on build 20200107; QTS 4.3.3.1161 on build 20200109; QTS 4.2.6 on build 20200109.
Exploitation status
- CISA has confirmed this is being exploited in the wild. That is an observation of real attacks, not a prediction.
- It is known to have been used in ransomware campaigns.
- US federal civilian agencies are required to remediate it by 2022-06-14. That deadline does not bind private companies, but it is a reasonable benchmark for how urgently CISA views it.
- A vendor advisory or patch reference has been published.
Required action
Apply updates per vendor instructions.
CISA’s wording, unedited.
What the metrics mean
- It is reachable over a network, without needing local access.
- For an attacker who can reach it, no special conditions are needed to exploit it.
- To exploit it, no account is needed.
- Beyond that, someone has to be persuaded to take an action first.
Scoring
- CVSS
- 6.1 (v3.1)
- Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N- Weakness
- CWE-79
- Assigned by
- security@qnapsecurity.com.tw
Dates
- Published
- 2020-10-28
- Last modified
- 2026-08-13
- Added to KEV
- 2022-05-24
- Remediation due
- 2022-06-14
- Sources
- CISA KEV, NVD
Affected products
- Qnap Qts- 4.2.6, 4.3.1.0013 - 4.3.3.1161, 4.3.4 - 4.3.4.1190, 4.3.6 - 4.3.6.1218, 4.4.0 - 4.4.1.1201, 4.4.2 - 4.4.2.1231, 4.2.6
As listed in the NVD configuration data. Not a statement about your estate.