CVE-2018-19950

CRITICAL

QNAP Music Station < 5.3.11 - Remote Command Injection

Title source: llm

Description

If exploited, this command injection vulnerability could allow remote attackers to execute arbitrary commands. This issue affects: QNAP Systems Inc. Music Station versions prior to 5.1.13; versions prior to 5.2.9; versions prior to 5.3.11.

References (1)

Core 1

Core References

Vendor Advisory x_refsource_misc

https://www.qnap.com/en/security-advisory/qsa-20-10

Scores

CVSS v3 9.8

EPSS 0.0336

EPSS Percentile 87.5%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

CWE

CWE-78 CWE-77

Status published

Products (1)

qnap/music_station 5.3.0 - 5.3.11

Published Nov 02, 2020

Tracked Since Feb 18, 2026