CVE-2018-14839: LG N1A1 NAS unauthenticated OS command injection via HTTP POST

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityUnauthenticated remote code execution with a CVSS 9.8 score, confirmed exploitation in CISA KEV, and a very high EPSS probability make this an urgent remediation target.

What it is

LG N1A1 NAS firmware 3718.510 contains an OS command injection flaw (CWE-78) reachable through HTTP POST parameters. Because the request requires no authentication or user interaction, an unauthenticated network attacker can execute arbitrary commands on the device. The flaw is listed in CISA's Known Exploited Vulnerabilities catalog, so it is a confirmed real-world target.

Impact

An attacker gains remote code execution with the privileges of the NAS web service, allowing full compromise of the device and any data or credentials it holds.

Attack surface

Reachable over the network via HTTP POST requests to the NAS web interface; the CVSS vector (AV:N/PR:N/UI:N) and the exploit reference both indicate no authentication and no user interaction are required.

Exploitation

CISA added this to the KEV catalog on 2022-03-25 with a 2022-04-15 remediation due date, and EPSS gives a 30-day exploitation probability of roughly 0.89 (99.8th percentile). A public exploit write-up is referenced, and no ransomware use is documented.

What to do

• Apply the vendor's update for LG N1A1 NAS firmware per CISA's required action; if no patch is available, retire or isolate the device.
• Remove the NAS web interface from internet exposure and restrict management access to a trusted internal network or VPN.
• Segment the NAS on its own VLAN with firewall rules limiting inbound HTTP/HTTPS to known administrative hosts.
• Monitor vendor advisories for an updated firmware release and track the KEV due date for remediation evidence.

Detection

• Inspect web server and NAS logs for HTTP POST requests containing shell metacharacters (;, |, $(), backticks) in parameters.
• Alert on unexpected child processes spawned by the NAS web service, especially shells or command interpreters.
• Monitor for outbound connections from the NAS to unfamiliar hosts, which may indicate command-and-control or data exfiltration.
• Baseline normal administrative source IPs and flag POST requests to the management interface from other addresses.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.