What is CVE-2013-10049?

CVE-2013-10049 is a vulnerability in Raidsonic Technology Gmbh Ib-Nas4220, classified under OS Command Injection. Published 2025-08-01.

Is CVE-2013-10049 known to be exploited?

1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

RCE in Raidsonic Technology Gmbh Ib-Nas4220

CVE-2013-10049

An OS command injection vulnerability exists in multiple Raidsonic NAS devices—specifically tested on IB-NAS5220 and IB-NAS4220—via the unauthenticated timeHandler.cgi endpoint exposed through the web interface. The CGI script fails to properly sanitize user-supplied input in the timeZone parameter of a POST request, allowing remote attackers to inject arbitrary shell commands.

Vulnerability class: Command Injection (OS Command Injection)

EPSS: 0.020 (78.3th percentile) — read the EPSS interpretation.

Affected products

Weakness classification (CWE)

CWE-78 — OS Command Injection

Public proof-of-concept exploits

rapid7/metasploit-framework

References

disclosure@vulncheck.com (exploit)
disclosure@vulncheck.com (exploit)
disclosure@vulncheck.com (exploit)
disclosure@vulncheck.com (technical-description, exploit)
disclosure@vulncheck.com (third-party-advisory)

Frequently asked questions

What is CVE-2013-10049?: CVE-2013-10049 is a vulnerability in Raidsonic Technology Gmbh Ib-Nas4220, classified under OS Command Injection. Published 2025-08-01.
Is CVE-2013-10049 known to be exploited?: 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.