The vulnerability have been reported to affect earlier versions of Helpdesk.

Published 6 y ago 2020-09-11 · modified 4 mo ago 2026-06-17 · JSON

CVSS

4.2

v3.1 · CNA

CISA KEV

not known exploited

EPSS

0.3%

percentile 25%

Public exploits

none known

The vulnerability have been reported to affect earlier versions of Helpdesk. If exploited, this improper certificate validation vulnerability could allow an attacker to spoof a trusted entity by interfering in the communication path between the host and client. QNAP has already fixed the issue in Helpdesk 3.0.3 and later.

Exploit prediction (EPSS)

0.32% probability of exploitation in the next 30 days, higher than 25% of all scored CVEs.

CVSS scores

Assigned by	Version	Score	Vector
CNA	3.1	4.2	`CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N`
CNA	3.1	4.2	`CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N`
NVD	3.1	5.9	`CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N`
NVD	2.0	4.3	`AV:N/AC:M/Au:N/C:N/I:P/A:N`

Affected products

QNAP Systems Inc. Helpdesk

Classification

Weakness

CWE-295 Improper Certificate Validation
CWE-297 Improper Validation of Certificate with Host Mismatch

References

qnap.com /zh-tw/security-advisory/qsa-20-05 · x_refsource_MISC, x_transferred

Sources

CVE List: CVE-2018-19946
NVD: CVE-2018-19946

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.