What is CVE-2019-7198?

CVE-2019-7198 is a critical-severity vulnerability in QNAP Qts, classified under Command Injection. CVSS score: 9.8/10. Published 2020-12-10.

How severe is CVE-2019-7198?

Critical severity. CVSS v3 base score is 9.8 out of 10.

RCE in QNAP Qts

CVE-2019-7198

This command injection vulnerability allows attackers to execute arbitrary commands in a compromised application. QNAP have already fixed this vulnerability in the following versions of QTS and QuTS hero. QuTS hero h4.5.1.1472 build 20201031 and later QTS 4.5.1.1456 build 20201015 and later QTS 4.4.3.1354 build 20200702 and later

Vulnerability class: Command Injection (OS Command Injection)

Published 2020-12-10 · last modified 2026-06-17.

CVSS v3 metric

CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

EPSS exploit prediction

EPSS: 0.027 (85.5th percentile), scored 2026-09-29.

Low probability of exploitation in the next 30 days, but still tracked. 85th percentile — 85.5% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS over last 30 days · oldest: 0.027 · newest: 0.027 · change: +0.000

Affected products

QNAP Qts
QNAP Quts Hero
QNAP Systems Inc. Qts — versions < 4.5.1.1456, < 4.4.3.1354
QNAP Systems Inc. Quts Hero — versions < h4.5.1.1472

Weakness classification (CWE)

References

www.qnap.com/en/security-advisory/qsa-20-16 (Vendor Advisory)

Frequently asked questions

What is CVE-2019-7198?: CVE-2019-7198 is a critical-severity vulnerability in QNAP Qts, classified under Command Injection. CVSS score: 9.8/10. Published 2020-12-10.
How severe is CVE-2019-7198?: Critical severity. CVSS v3 base score is 9.8 out of 10.