QNAP NAS File Station Cross-Site Scripting Vulnerability

MOYENNE 6.1EXPLOITED (CISA KEV)CVE-2018-19953 · Published 28/10/2020 · updated 01/10/2026

QNAP NAS File Station Cross-Site Scripting Vulnerability. Actively exploited: CISA added this vulnerability to its Known Exploited Vulnerabilities catalog on 24/05/2022. Patch affected systems as an emergency. It is known to be used in ransomware campaigns.

En bref

CVE-2018-19953 est une vulnérabilité MOYENNE (CVSS 6.1).
Exploitée activement : la CISA l'a ajoutée au catalogue KEV le 24/05/2022.
Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 30.5%, plus élevée que 98.2% des vulnérabilités.
Aucune version corrigée n'est encore connue : suivez l'avis de l'éditeur dans les références.

Package	Affected versions	Patched versions
Network Attached Storage (NAS) QNAP	Versions not published yet (product named by CISA KEV)

Description

If exploited, this cross-site scripting vulnerability could allow remote attackers to inject malicious code. QNAP has already fixed the issue in the following QTS versions. QTS 4.4.2.1231 on build 20200302; QTS 4.4.1.1201 on build 20200130; QTS 4.3.6.1218 on build 20200214; QTS 4.3.4.1190 on build 20200107; QTS 4.3.3.1161 on build 20200109; QTS 4.2.6 on build 20200109.

References

qnap.com/zh-tw/security-advisory/qsa-20-01 · Vendor Advisory
cisa.gov/known-exploited-vulnerabilities-catalog · US Government Resource
CISA KEV · CVE-2018-19953

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free