CVE-2018-19953

CVE-2018-19953 is a cross-site scripting (XSS) flaw in File Station, the web-based file management application bundled with QNAP network-attached storage (NAS) devices. A remote attacker can inject malicious code through the application, which then executes in the browser of users who access the File Station interface. Successful injection can let the attacker run scripts in an authenticated user's session, potentially stealing credentials or performing actions on the NAS with that user's privileges. Any organization or individual running File Station on a QNAP NAS is affected; the specific vulnerable version ranges are not provided in the available data and should be confirmed against QNAP's advisory. The flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2022-05-24 with a known ransomware association, indicating active in-the-wild exploitation, though no public proof-of-concept code is known.

What to do: Apply QNAP's security updates per vendor instructions, as required by CISA's KEV listing, and confirm the affected QTS/File Station versions in QNAP's advisory before scheduling the update. Until patched, restrict File Station's internet exposure via firewall rules, access controls, or VPN-only access, and review NAS logs for signs of intrusion given the known ransomware association.