← Global Threat Landscape
CVE-2018-19949
CWE-20
Critical
102.9
RPSRPS range: 0–105; KEV-listed vulnerabilities can receive an exploitation amplifier.
Description
If exploited, this command injection vulnerability could allow remote attackers to run arbitrary commands. QNAP has already fixed the issue in the following QTS versions. QTS 4.4.2.1231 on build 20200302; QTS 4.4.1.1201 on build 20200130; QTS 4.3.6.1218 on build 20200214; QTS 4.3.4.1190 on build 20200107; QTS 4.3.3.1161 on build 20200109; QTS 4.2.6 on build 20200109.
Source: NVD
Signals
- CVSS
- 9.8
- Critical · v3.1
- EPSS
- 28.42%
- Probability of exploitation in the next 30 days (FIRST)
- CISA KEV
- In CISA KEV since May 2022
- Fix commit
- No known fix commit
- Sources: MoreFixes, FreshFixes
- Weakness
- CWE-20
- CWE-20, CWE-77
- Published
- 28 Oct 2020
- Last modified 2 Oct 2026
How to read these signals: RPS · EPSS · CISA KEV · Data sources
Get this score from the API
curl -H "Authorization: Bearer dsec_live_xxxxxxxx" \
https://api.intelligence.devsecure.io/api/v1/rps/CVE-2018-19949Replace the placeholder with your key. Get a free API key or rank your own CVEs.
Data as of 7 Oct 2026, 05:16 UK time