Vulnerability Intelligence Report
QNAP NAS File Station Cross-Site Scripting Vulnerability
CVE-2018-19953
If exploited, this cross-site scripting vulnerability could allow remote attackers to inject malicious code. QNAP has already fixed the issue in the following QTS versions. QTS 4.4.2.1231 on build 20200302; QTS 4.4.1.1201 on build 20200130; QTS 4.3.6.1218 on build 20200214; QTS 4.3.4.1190 on build 20200107; QTS 4.3.3.1161 on build 20200109; QTS 4.2.6 on build 20200109.
CISA KEV
SSVC: Active Exploitation
Cross-Site Scripting (XSS)
CVSS Base Score
6.1
MEDIUM
Exploitability:2.9
Impact Score:2.8
EPSS Probability:23.89%
Executive Threat Verdict
Evaluating...
Evaluating Threat Landscape...
Assessing known weaponization, exploitation telemetry, and federal advisories.
Attack Surface
—
Authentication
—
Weaponization
—
SSVC Action
—
Weaknesses (CWE)
Affected Products & Versions
| Vendor | Product | Affected Versions |
|---|---|---|
| QNAP Systems Inc. | QTS | unspecified < 4.4.2.1231 (affected) |
| QNAP Systems Inc. | QTS | unspecified < 4.4.1.1201 (affected) |
| QNAP Systems Inc. | QTS | unspecified < 4.3.6.1218 (affected) |
| QNAP Systems Inc. | QTS | unspecified < 4.3.4.1190 (affected) |
| QNAP Systems Inc. | QTS | unspecified < 4.3.3.1161 (affected), unspecified < 4.2.6 (affected) |
References & Technical Advisories
No reference links found.
Threat Intelligence Signals
CISA KEV
ACTIVE IN CATALOG
EPSS Score
23.894%
GitHub Advisory
Vulnerability Class
Cross-Site Scripting (XSS)
Identity & Timeline
| Status | PUBLISHED |
| Assigning Authority | QNAP Systems, Inc. · Vendor · Taiwan |
| Reserved | 2018-12-07T00:00:00 |
| Published | 2020-10-28T17:55:18 |
| Last Updated | 2026-08-13T03:55:37 |
Community Chatter & Buzz