QNAP Video Station CVE-2026-26244

Requires a valid authenticated user account on the QNAP NAS (CVSS PR:L) with network access to the Video Station application's web interface; Video Station must be installed and running (it is an optional QNAP app, not part of the base NAS OS). No user interaction is needed (UI:N) once authenticated. The primary limiting factor is the authentication prerequisite - an unauthenticated outsider cannot trigger this directly - and the impact is bounded to confidentiality (VC:H only), so it does not by itself grant code execution or service disruption despite the description's wording. Running a version at or above Video Station 5.8.8 removes the exposure.

This is a moderate-priority, not a drop-everything, issue. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) describes a network-reachable, low-complexity SQL injection, but the critical mitigating signal is PR:L - exploitation requires an existing authenticated user account on the QNAP NAS, which sharply narrows the attacker population to insiders or anyone who has already obtained credentials. The impact set is telling: only VC:H (confidentiality) is asserted, with VI:N and VA:N, which is consistent with classic SQLi data disclosure rather than full system takeover. There is a notable conflict between the free-text description ('execute unauthorized code or commands') and the CVSS vector, which records NO integrity or availability impact (VI:N/VA:N) - the vendor-assigned score does not support a code-execution interpretation, so the description's 'code or commands' language appears to be boilerplate and should be treated as data exfiltration unless QNAP clarifies otherwise. No EPSS score, no CISA KEV listing, and no public POC were provided, so there is no evidence of active or at-scale exploitation; the authentication precondition further argues against opportunistic mass exploitation. Overall: a real vulnerability worth patching on normal cadence, but the 7.1 base score overstates practical urgency given the required foothold and confidentiality-only impact.

An attacker who already holds a low-privileged user account on a QNAP NAS running Video Station (for example a shared family/office login or phished credentials) sends crafted input through a Video Station request parameter that is concatenated into a SQL query. The injection lets them read database contents beyond their authorization, potentially including other users' media metadata or account data. No public exploit code was identified at time of analysis, and user interaction is not required once the attacker is authenticated.