Which versions of Qunetswitch are affected by CVE-2026-22902?

Organizations using A command injection vulnerability should be aware of moderate risk from CVE-2026-22902, a OS command injection vulnerability rated CVSS 5.7.. A patch is available.

How to fix or mitigate CVE-2026-22902?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Validate input sanitization for user-controlled parameters.

Qunetswitch CVE-2026-22902

Q: What is the CVSS score of CVE-2026-22902?

CVE-2026-22902 has a CVSS 4.0 base score of 5.7 (Medium). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-13723 MEDIUM

OS Command Injection (CWE-78)

2026-03-20 qnap

Command Injection Qunetswitch

5.7

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.7 MEDIUM

CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Local

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Apr 16, 2026 - 05:29 EUVD

2.0.5.0906

EUVD ID Assigned

Mar 20, 2026 - 16:30 euvd

EUVD-2026-13723

Analysis Generated

Mar 20, 2026 - 16:30 vuln.today

CVE Published

Mar 20, 2026 - 16:21 nvd

MEDIUM 5.7

DescriptionCVE.org

A command injection vulnerability has been reported to affect QuNetSwitch. If a local attacker gains an administrator account, they can then exploit the vulnerability to execute arbitrary commands.

We have already fixed the vulnerability in the following version: QuNetSwitch 2.0.5.0906 and later

AnalysisAI

Arbitrary command execution in QuNetSwitch can be achieved by local attackers with administrator privileges due to insufficient input validation in command processing. This vulnerability affects QuNetSwitch versions prior to 2.0.5.0906, allowing authenticated high-privilege users to bypass security controls and execute system commands. No patch is currently available for affected versions.

Technical ContextAI

The vulnerability is classified as CWE-78 (Improper Neutralization of Special Elements used in an OS Command), which represents a command injection flaw. This occurs when user-controlled input is passed unsanitized to system command execution functions without proper escaping or validation. QNAP QuNetSwitch (identified via CPE cpe:2.3:a:qnap_systems_inc.:qunetswitch:*:*:*:*:*:*:*:*) is a network switching/management platform where an administrator account in the application layer can trigger OS-level command execution. The root cause likely stems from insufficient input sanitization in administrative functions that interact with underlying system commands.

RemediationAI

Immediately upgrade QuNetSwitch to version 2.0.5.0906 or later, which contains the fix for this command injection vulnerability. Refer to the QNAP security advisory at https://www.qnap.com/en/security-advisory/qsa-26-11 for detailed upgrade instructions specific to your deployment. As an interim control pending patching, restrict administrator account creation and access to the QuNetSwitch administrative interface to trusted personnel only, and consider disabling or isolating QuNetSwitch instances that handle sensitive network operations until patching is complete. Network segmentation to limit administrative access to QuNetSwitch to a protected administrative subnet can further reduce exposure.