Skip to content
Fencer Intel
medium 6.1

CVE-2018-19957 json

Insufficient HTTP Security Headers in QTS, QuTS hero, and QuTScloud

published 5y ago modified 4mo ago also EUVD-2018-11628

cvss
6.1
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
0.7%
EPSS 0.7% chance of exploitation in 30 days, percentile 53%
public exploits
0
none known

Summary

A vulnerability involving insufficient HTTP security headers has been reported to affect QNAP NAS running QTS, QuTS hero, and QuTScloud. This vulnerability allows remote attackers to launch privacy and security attacks. We have already fixed this vulnerability in the following versions: QTS 4.5.4.1715 build 20210630 and later QuTS hero h4.5.4.1771 build 20210825 and later QuTScloud c4.5.6.1755 build 20210809 and later

Patch / fix

  • QNAP Systems Inc. QTS 4.5.4.1715 build 20210630
  • QNAP Systems Inc. QuTS hero h4.5.4.1771 build 20210825
  • QNAP Systems Inc. QuTScloud c4.5.6.1755 build 20210809

Is CVE-2018-19957 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Exploit prediction

0.71% chance of exploitation in the next 30 days, higher than 53% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by version score vector
NVD 3.1 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
NVD 2.0 4.3 AV:N/AC:M/Au:N/C:N/I:P/A:N

Affected products

  • QNAP Systems Inc. QTS
  • QNAP Systems Inc. QuTS hero
  • QNAP Systems Inc. QuTScloud

Classification

Weakness
  • CWE-1021 Improper Restriction of Rendered UI Layers or Frames

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.