{"id":"CVE-2018-19943","kind":"vulnerability","aliases":["CVE-2018-19943"],"related":[],"title":"QNAP Network Attached Storage (NAS): QNAP NAS File Station Cross-Site Scripting Vulnerability","description":"If exploited, this cross-site scripting vulnerability could allow remote attackers to inject malicious code. QNAP has already fixed these issues in the following QTS versions. QTS 4.4.2.1270 build 20200410 and later QTS 4.4.1.1261 build 20200330 and later QTS 4.3.6.1263 build 20200330 and later QTS 4.3.4.1282 build 20200408 and later QTS 4.3.3.1252 build 20200409 and later QTS 4.2.6 build 20200421 and later","summary":"QNAP NAS File Station has a cross-site scripting flaw that lets remote attackers inject malicious script. An attacker can run script in a logged-in user's browser session on the NAS web interface, which the sources tie to ransomware campaigns.","severity":"high","cvss":8.0,"epss":0.22682,"exploited":true,"exploited_at":"2022-05-24T00:00:00+00:00","products":[{"name":"QNAP Network Attached Storage (NAS)","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["exploited","file-station","infrastructure","nas","qnap","ransomware","self-hosted"],"not_affected_if":["managed-hosting"],"how_to_check":"Confirm the NAS model and firmware version under Control Panel > System in the QNAP web UI; the sources do not give affected version ranges.","fix":"Apply the QNAP firmware and File Station updates per the vendor instructions referenced by CISA; the sources do not name the fixed version.","status":"open","published_at":"2020-10-28T18:15:12+00:00","first_seen_at":"2026-10-23T19:11:52+00:00","triaged_at":"2026-10-23T21:15:50+00:00","updated_at":"2026-10-23T21:57:35+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-10-23T21:15:50Z","model":"claude-haiku-5-5","output":{"fix":"Apply the QNAP firmware and File Station updates per the vendor instructions referenced by CISA; the sources do not name the fixed version.\nunknown","reach":"internet","impact":"medium","summary":"QNAP NAS File Station has a cross-site scripting flaw that lets remote attackers inject malicious script. An attacker can run script in a logged-in user's browser session on the NAS web interface, which the sources tie to ransomware campaigns.","category":"infrastructure","who_cares":["qnap","nas","self-hosted","file-station"],"confidence":0.5,"needs_auth":"unknown","worst_case":"Attacker runs script in a user's NAS session, reading or changing files.","analyst_note":"Find the affected and fixed QNAP firmware versions and the vendor advisory for CVE-2018-19943 (QNAP security advisories page), since the sources give none.","how_to_check":"Confirm the NAS model and firmware version under Control Panel > System in the QNAP web UI; the sources do not give affected version ranges.\nunknown\nunknown","needs_analyst":true,"not_affected_if":["managed-hosting"],"user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.0005,"input_tokens":2846,"output_tokens":430,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-19943':17A,20A '-2018':16A,19A '20200330':117C,123C '20200408':129C '20200409':135C '20200410':111C '20200421':141C '4.2.6':139C '4.3.3.1252':133C '4.3.4.1282':127C '4.3.6.1263':121C '4.4.1.1261':115C '4.4.2.1270':109C 'allow':90C 'alreadi':99C 'attach':3A 'attached':23A 'attack':51B,56B,92C 'browser':67B 'build':110C,116C,122C,128C,134C,140C 'campaign':80B 'code':96C 'could':89C 'cross':11A,44B,85C 'cross-sit':10A,43B,84C 'cve':15A,18A 'exploit':26B,82C 'file':8A,28B,39B 'file-st':27B 'fix':100C 'flaw':47B 'follow':105C 'host':36B 'infrastructur':30B 'inject':52B,94C 'interfac':73B 'issu':102C 'later':113C,119C,125C,131C,137C,143C 'let':49B 'log':63B 'logged-in':62B 'malici':53B,95C 'nas':5A,7A,25A,31B,38B,71B 'network':2A,22A 'qnap':1A,6A,21A,32B,37B,97C 'qts':106C,108C,114C,120C,126C,132C,138C 'ransomwar':33B,79B 'remot':50B,91C 'run':58B 'script':13A,46B,54B,59B,87C 'self':35B 'self-host':34B 'session':68B 'site':12A,45B,86C 'sourc':76B 'station':9A,29B,40B 'storag':4A 'storage':24A 'tie':77B 'user':65B 'version':107C 'vulner':14A,88C 'web':72B","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2020-10-28T18:15:12+00:00","kev":{"dateAdded":"2022-05-24","dueDate":"2022-06-14","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"Known"},"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H","cvss_by":"security@qnapsecurity.com.tw","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2018-19943","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2018-19943","severity":null,"published_at":"2022-05-24T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:52+00:00","fetched_at":"2026-10-25T20:35:36+00:00","note":null},{"source":"epss","external_id":"CVE-2018-19943","url":"https://api.first.org/data/v1/epss?cve=CVE-2018-19943","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:45+00:00","fetched_at":"2026-10-23T19:13:45+00:00","note":null},{"source":"nvd","external_id":"CVE-2018-19943","url":"https://nvd.nist.gov/vuln/detail/CVE-2018-19943","severity":null,"published_at":"2020-10-28T18:15:12+00:00","modified_at":"2026-08-13T05:17:17+00:00","first_seen_at":"2026-10-23T21:57:35+00:00","fetched_at":"2026-10-23T21:57:35+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}