Actively exploited in the wild

QNAP NAS File Station Cross-Site Scripting Vulnerability

QNAP - Network Attached Storage (NAS) · Listed in the CISA KEV since 2022-05-24. This indicates confirmed attacks in production environments.

Required action: Apply updates per vendor instructions.

CVE-2018-19953

MediumCVSS 6.1KEV

Published: 28/10/2020(UTC)Updated: 13/08/2026(UTC)Translated: 13/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Very high risk

23.89%

98th percentile - higher than 98% of all known CVEs

Summary

A cross-site scripting (XSS) vulnerability in QNAP QTS systems could allow remote attackers to inject malicious code. Fixed in specific QTS versions.

Risk Assessment

An attacker could exploit XSS to hijack user sessions, steal data, or spread malware within the QNAP environment.

Recommendation

Update QTS to the versions listed in the description or later to mitigate the vulnerability.

Original NVD description (English source)

If exploited, this cross-site scripting vulnerability could allow remote attackers to inject malicious code. QNAP has already fixed the issue in the following QTS versions. QTS 4.4.2.1231 on build 20200302; QTS 4.4.1.1201 on build 20200130; QTS 4.3.6.1218 on build 20200214; QTS 4.3.4.1190 on build 20200107; QTS 4.3.3.1161 on build 20200109; QTS 4.2.6 on build 20200109.