RCE in Raidsonic Technology Gmbh Ib-Nas4220
CVE-2013-10049
An OS command injection vulnerability exists in multiple Raidsonic NAS devices—specifically tested on IB-NAS5220 and IB-NAS4220—via the unauthenticated timeHandler.cgi endpoint exposed through the web interface. The CGI script fails to properly sanitize user-supplied input in the timeZone parameter of a POST request, allowing remote attackers to inject arbitrary shell commands.
Vulnerability class: Command Injection (OS Command Injection)
Published · last modified .
EPSS exploit prediction
EPSS: 0.028 (86.0th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 86th percentile — 86.0% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.020 · newest: 0.028 · change: +0.008
Affected products
Weakness classification (CWE)
Public proof-of-concept exploits
References
- raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/l… (exploit)
- www.exploit-db.com/exploits/24499 (exploit)
- www.exploit-db.com/exploits/28508 (exploit)
- web.archive.org/web/20160616174425/http://www.s3cur1ty.de/m1adv2013-010 (technical-description, exploit)
- www.vulncheck.com/advisories/raidsonic-nas-devices-unauth-rce (third-party-advisory)
Frequently asked questions
- What is CVE-2013-10049?
- CVE-2013-10049 is a vulnerability in Raidsonic Technology Gmbh Ib-Nas4220, classified under OS Command Injection. Published 2025-08-01.
- Is CVE-2013-10049 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.