What is CVE-2018-0730?

CVE-2018-0730 is a critical-severity vulnerability in Qnap Qts, classified under Command Injection. CVSS score: 9.8/10. Published 2019-12-04.

How severe is CVE-2018-0730?

Critical severity. CVSS v3 base score is 9.8 out of 10.

RCE in Qnap Qts

CVE-2018-0730

This command injection vulnerability in File Station allows attackers to execute commands on the affected device. To fix the vulnerability, QNAP recommend updating QTS to their latest versions.

Vulnerability class: Command Injection (OS Command Injection)

EPSS: 0.020 (78.3th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

Affected products

Qnap Qts — versions 4.2.6, 4.3.3.0868, 4.3.3.0998
N/a Qnap Nas Devices — versions QTS 4.4.1: before build 20190918, QTS 4.3.6: before build 20190328, QTS 4.3.4: before build 20190325, QTS 4.3.3: before build 20190325, QTS 4.2.6: before build 20190325

Weakness classification (CWE)

CWE-77 — Command Injection

References

security@qnapsecurity.com.tw (x_refsource_CONFIRM, Vendor Advisory)

Frequently asked questions

What is CVE-2018-0730?: CVE-2018-0730 is a critical-severity vulnerability in Qnap Qts, classified under Command Injection. CVSS score: 9.8/10. Published 2019-12-04.
How severe is CVE-2018-0730?: Critical severity. CVSS v3 base score is 9.8 out of 10.