QNAP Video Station CVE-2026-26245

Exploitation requires the attacker to first possess a valid Video Station user account (PR:L) on the target QNAP NAS - this authentication requirement is the primary limiting factor and excludes fully unauthenticated internet attackers. Beyond holding an account, no special non-default configuration is indicated: the SQL injection is reachable over the network (AV:N) with low complexity (AC:L) and no user interaction (UI:N) against devices running the Video Station application prior to version 5.8.8. Realistic risk is therefore highest on NAS devices that expose Video Station to untrusted networks and provision multiple or guest-level user accounts; single-admin, LAN-only deployments face materially lower exposure.

This is a legitimate but moderate-priority issue rather than a critical emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) shows network-reachable, low-complexity exploitation with no user interaction, which favors attackers - but it requires PR:L, meaning the attacker must already hold a valid user account on the device, a meaningful barrier against opportunistic internet-wide scanning. Impact is bounded: VC:H (SQLi enables reading sensitive database contents) but VI:N and only VA:L, so this is primarily a confidentiality/data-disclosure flaw despite the description's claim of 'unauthorized code or commands' - note that mismatch, as the vendor's own CVSS vector does not reflect integrity impact (VI:N), suggesting the practical outcome is database data exposure rather than full RCE. No EPSS score, no CISA KEV listing, and no public POC were provided, so there is no evidence of active or imminent widespread exploitation; the dominant risk signal is the authenticated-network vector, not exploitation telemetry. Overall: patch in normal cycle, prioritizing internet-exposed QNAP NAS devices running Video Station with multiple or untrusted user accounts.

An attacker who has obtained any valid Video Station user account (via phishing, credential reuse, or a low-privilege account on a shared NAS) submits crafted input to a vulnerable query parameter, injecting SQL that is executed by the backend database. This allows extraction of sensitive data from the application database and, per the vendor, potential execution of unauthorized commands. No public exploit code was identified at time of analysis, and low attack complexity means exploitation is straightforward once account access is held.