CVE-2018-14839

LG N1A1 NAS firmware 3718.510 contains an OS command injection flaw (CWE-78) that allows an unauthenticated attacker to execute arbitrary commands on the device. The flaw is triggered over the network by sending crafted parameters in an HTTP POST request to the NAS web interface, requiring no credentials or user interaction. Successful exploitation gives the attacker remote code execution on the device, with full confidentiality, integrity, and availability impact per the critical 9.8 CVSS score. Only LG N1A1 NAS devices (specifically firmware 3718.510 per the disclosure) are affected. Exploitation is confirmed in the wild: the flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2022-03-25, carries a very high 89.4% EPSS probability of exploitation within 30 days, and a public proof-of-concept write-up is available.

What to do: Apply updates per LG/vendor instructions as required by CISA's KEV listing; given the device's age, if no updated firmware is obtainable, replace or isolate the NAS. Immediately check whether the N1A1 web interface is exposed to the internet (port forwarding, UPnP) and restrict HTTP access to trusted networks or a VPN. Review device logs for suspicious HTTP POST requests and unexpected commands as evidence of compromise.