CVE-2013-10049CWE-78

Raidsonic NAS Devices Unauthenticated Remote Command Execution

Critical · published August 1, 2025

CVSS v4.0
9.3
EPSS
3%
Percentile
86.3
In the wild
Unconfirmed
What it is

An OS command injection vulnerability exists in multiple Raidsonic NAS devices—specifically tested on IB-NAS5220 and IB-NAS4220—via the unauthenticated timeHandler.cgi endpoint exposed through the web interface. The CGI script fails to properly sanitize user-supplied input in the timeZone parameter of a POST request, allowing remote attackers to inject arbitrary shell commands.

The record
Technical detail
CVSS v4.0
9.3 · CRITICAL
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.02784 · 86.3th percentile
Weakness
CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Published
2025-08-01T20:47Z
EPSS history
Timeline
  • 01 AUG 20:47Z
    Raidsonic NAS Devices Unauthenticated Remote Command Execution
    cvelistv5