VulnerabilityModified
CVE-2019-7198
This command injection vulnerability allows attackers to execute arbitrary commands in a compromised application.
CRITICAL 9.8EPSS 2.72%
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (2.72%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
This command injection vulnerability allows attackers to execute arbitrary commands in a compromised application. QNAP have already fixed this vulnerability in the following versions of QTS and QuTS hero. QuTS hero h4.5.1.1472 build 20201031 and later QTS 4.5.1.1456 build 20201015 and later QTS 4.4.3.1354 build 20200702 and later
- CVSS 3.1
- 9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 2.72% probability · 85th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-77, CWE-78
- Affected
- qnap/quts hero · qnap/qts
- Source
- security@qnapsecurity.com.tw
References
- https://www.qnap.com/en/security-advisory/qsa-20-16Vendor Advisory
- https://www.qnap.com/en/security-advisory/qsa-20-16Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.