---
id: "CVE-2018-19949"
kind: "vulnerability"
aliases: ["CVE-2018-19949"]
title: "QNAP Network Attached Storage (NAS): QNAP NAS File Station Command Injection Vulnerability"
severity: "critical"
cvss: 9.8
epss: 0.3016
exploited: true
status: "open"
category: "infrastructure"
products: [{"name": "QNAP Network Attached Storage (NAS)", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["exploited", "file-station", "infrastructure", "nas", "qnap", "ransomware", "self-hosted"]
not_affected_if: ["default-config"]
published_at: "2020-10-28T18:15:12+00:00"
first_seen_at: "2026-10-23T19:11:52+00:00"
updated_at: "2026-10-23T21:57:35+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2018-19949", "first_seen_at": "2026-10-23T19:11:52+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2018-19949", "first_seen_at": "2026-10-23T19:13:45+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-19949", "first_seen_at": "2026-10-23T21:57:35+00:00"}]
---

# QNAP Network Attached Storage (NAS): QNAP NAS File Station Command Injection Vulnerability

QNAP NAS File Station has a command injection flaw that lets remote attackers run commands on the device. The flaw is listed in CISA's Known Exploited Vulnerabilities catalog, so attacks have been observed in the wild.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:QNAP Network Attached Storage (NAS) affected ? fixed ?

## How to check

Check the QNAP firmware version under Control Panel > System > Firmware Update and compare it with the QNAP advisory for CVE-2018-19949.

## Fix

Apply the QNAP firmware update that fixes CVE-2018-19949, per vendor instructions; the fixed version is not named in the sources.

## Timeline

- 2026-10-23T19:11:52+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2018-19949
- 2026-10-23T19:13:45+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2018-19949
- 2026-10-23T21:57:35+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2018-19949

## From the sources

If exploited, this command injection vulnerability could allow remote attackers to run arbitrary commands. QNAP has already fixed the issue in the following QTS versions. QTS 4.4.2.1231 on build 20200302; QTS 4.4.1.1201 on build 20200130; QTS 4.3.6.1218 on build 20200214; QTS 4.3.4.1190 on build 20200107; QTS 4.3.3.1161 on build 20200109; QTS 4.2.6 on build 20200109.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_