CVE-2018-19953
KEVRansomware UseQNAP NAS File Station Cross-Site Scripting Vulnerability
Description
A cross-site scripting vulnerability affecting QNAP NAS File Station could allow remote attackers to inject malicious code.
If exploited, this cross-site scripting vulnerability could allow remote attackers to inject malicious code. QNAP has already fixed the issue in the following QTS versions. QTS 4.4.2.1231 on build 20200302; QTS 4.4.1.1201 on build 20200130; QTS 4.3.6.1218 on build 20200214; QTS 4.3.4.1190 on build 20200107; QTS 4.3.3.1161 on build 20200109; QTS 4.2.6 on build 20200109.
CVSS 3.1 vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NPublishedOct 28, 2020
Last modifiedOct 1, 2026
Added to KEVMay 24, 2022
Remediation dueJun 14, 2022
References
- qnap.com/zh-tw/security-advisory/qsa-20-01Vendor Advisory
- cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-19953US Government Resource
0 recent articles mention this CVE
74
Risk assessment · High
Actively exploited and used by ransomware crews. Patch immediately.
- Exploitation
- Confirmed in the wild (CISA KEV)
- Federal remediation deadline
- Overdue by 1595 days
- Ransomware
- Used in known ransomware campaigns
- CVSS
- 6.1 MEDIUM
- EPSS (30-day exploit probability)
- 30.5% · top 2% of all CVEs
- Weakness
- CWE-79
- Attack vector
- Network, remotely reachable
Recommended actions
- 1.Apply updates per vendor instructions.
- 2.Treat as emergency change: patch or isolate internet-facing instances first.
- 3.Review exposure: confirm which instances are reachable from the internet and restrict access until patched.
- 4.Hunt for compromise: review logs for the disclosure window, not just from the patch date.
- 5.Verify offline/immutable backups and segment the affected systems. This flaw is used for ransomware initial access.
Assessment is derived automatically from the live signals above; verify against your own asset inventory.