QNAP Download Station CVE-2026-34014

Exploitation requires that the attacker already hold an administrator account on the QNAP device AND have local access to that device running a vulnerable Download Station build (prior to 5.10.1.312 or 5.11.2.321). The decisive limiting factor is the administrator-privilege prerequisite (PR:H) combined with local-only reach (AV:L): there is no remote or unauthenticated path, and no user interaction is needed once admin access is held. In practice this is a trust-boundary/privilege-escalation condition - it matters where admin accounts are shared, weakly protected, or where an attacker has already gained an admin foothold; it is not exploitable against a hardened NAS whose admin credentials remain uncompromised.

This is a moderately severe but access-gated issue, not a drop-everything emergency. The vendor-supplied CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:H/UI:N, VC:H/VI:H/VA:H) is internally consistent with the description: exploitation is LOCAL (AV:L) and requires an attacker who already holds an administrator account (PR:H), after which full confidentiality, integrity, and availability impact follows. The 8.4 (High) score is driven almost entirely by the triple-high impact, while the two factors that would make this widely dangerous - remoteness and lack of privilege requirement - are absent. No EPSS score, no CISA KEV listing, and no public POC were provided in the input, so there is no public exploit identified at time of analysis; the only exploitation 'status' signal is the vendor report itself (qnap), with no SSVC decision data supplied. CONFLICTING SIGNAL TO NOTE: the input Tags label this 'Information Disclosure', but both the CWE (CWE-732, Incorrect Permission Assignment) and the CVSS impacts (VC:H/VI:H/VA:H) indicate full system compromise including integrity and availability, not mere disclosure - treat the 'Information Disclosure' tag as understating the impact. The high privilege prerequisite (an already-compromised admin account) means realistic risk is privilege/trust-boundary escalation on the NAS rather than mass remote exploitation.

An attacker who has already obtained an administrator account on a QNAP NAS running a vulnerable Download Station version abuses the incorrectly assigned permissions on a critical resource to overstep the intended boundary and fully compromise the underlying system. Because the CVSS vector is AV:L/AC:L/PR:H, this is low-complexity local post-authentication abuse rather than a remote entry point. No public proof-of-concept was identified in the provided data.