CVE-2013-10049 CRITICAL

CVE-2013-10049: Raidsonic NAS Devices Unauthenticated Remote Command Execution

Vendor Raidsonic Technology Gmbh
Product IB-NAS5220
Weakness CWE-78
Published August 1, 2025
Last update April 7, 2026
View on NVD All CVEs

CVSS base score

9.3/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

What the vulnerability does

01Description

An OS command injection vulnerability exists in multiple Raidsonic NAS devices—specifically tested on IB-NAS5220 and IB-NAS4220—via the unauthenticated timeHandler.cgi endpoint exposed through the web interface. The CGI script fails to properly sanitize user-supplied input in the timeZone parameter of a POST request, allowing remote attackers to inject arbitrary shell commands.

Key dates

02Disclosure timeline

August 1, 2025 CVE published
April 7, 2026 Record updated