QNAP Video Station CVE-2025-66275

Requires the attacker to first obtain a valid user account on the target QNAP NAS (PR:L), and the Video Station application must be installed and running on an affected firmware/app version (5.8.x below 5.8.5). Exploitation is network-reachable without user interaction, but the CVSS 4.0 AT:P flag signals an additional attack requirement outside the attacker's control. The authentication requirement is the primary limiting factor, confining exploitation to attackers with existing credentials or the ability to register/compromise a low-privilege account; internet-exposed NAS devices with open registration or weak accounts face the greatest exposure.

This is a moderate-priority vulnerability that is unlikely to be mass-exploited but warrants prompt patching on exposed devices. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:L/UI:N) indicates network-reachable, low-complexity exploitation but requires an existing low-privileged user account (PR:L) and carries an attack requirement (AT:P), meaning conditions beyond the attacker's control must hold. The description characterizes the flaw strictly as reading 'unexpected files or system data' - a confidentiality impact - yet the vendor scored integrity and availability as High (VI:H/VA:H); this is a notable conflict, as a read-only path traversal (CWE-22) does not obviously support integrity or availability compromise, so the VI:H/VA:H ratings should be verified with QNAP. No EPSS score, KEV listing, or POC was provided; there is no public exploit identified at time of analysis, and the KEV/EPSS absence should not be read as evidence of safety given how recently this was disclosed. On balance the authentication requirement meaningfully limits the attacker population, keeping real-world risk below what the 7.7 base score alone might suggest, while file-disclosure of system data (e.g., credentials or configuration) could still enable privilege escalation or lateral movement.

An attacker who has obtained or registered a low-privileged account on a QNAP NAS running Video Station sends a crafted request containing directory-traversal sequences to a Video Station endpoint. The application fails to sanitize the path, returning the contents of files outside the intended media directory - potentially system configuration or credential files. No public exploit code is identified at time of analysis, and user interaction is not required.