CVE-2018-19949

CVE-2018-19949 is a command injection flaw (CWE-77/CWE-78, with CWE-20 input-validation weakness) in File Station, the web-based file management application on QNAP network-attached storage (NAS) devices. By sending crafted requests to the File Station service, a remote attacker can cause the NAS to execute arbitrary operating system commands. Successful exploitation yields command execution on the device, which attackers can use to install malware or ransomware, access or destroy data stored on the NAS, and pivot deeper into the victim network. Any QNAP NAS running the File Station component is potentially affected; the source data does not specify an exact affected version range, so defenders should consult QNAP's advisory. The flaw is in CISA's Known Exploited Vulnerabilities catalog (added 2022-05-24) with known ransomware use, confirming active exploitation in the wild, and EPSS rates near-term exploitation risk at about 24% (98th percentile).

What to do: Apply the latest QNAP firmware/QTS updates per the vendor's instructions, as required by CISA's KEV listing. Restrict internet exposure of the NAS web interface and File Station (e.g., firewall rules or VPN-only access instead of port forwarding) to reduce attack surface. Check NAS and network logs for signs of unexpected command execution or ransomware activity, given the known ransomware abuse of this flaw.