QNAP Video Station CVE-2026-44084

Exploitation requires a QNAP NAS with the Video Station (VideoStationPro) application installed and network-reachable to the attacker; per the vendor CVSS vector (AV:N/AC:L/PR:N/UI:N) no authentication, no special configuration, and no user interaction are needed against a default installation, so any exposed Video Station instance running a version prior to 5.8.8 is vulnerable. The primary limiting factors are that Video Station must be explicitly installed (it is an optional add-on, not part of the base QTS/QuTS firmware) and that the service must be reachable by the attacker - internet-exposed NAS devices are at highest risk, while instances confined to a trusted LAN reduce the exposure. Impact is limited to confidentiality (VC:H, VI:N, VA:N): data disclosure only, with no integrity modification or availability loss.

This is a genuinely high-priority information-disclosure flaw, not a paper-tiger high-CVSS issue. The QNAP-supplied CVSS 4.0 vector (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H) scores 8.7 and describes network-reachable, low-complexity, unauthenticated (PR:N) exploitation with no user interaction and high confidentiality impact - the easiest-to-exploit profile short of remote code execution. CWE-639 (authorization bypass through user-controlled key) is a classic IDOR pattern that is typically trivial to weaponize once the parameter is known, which is consistent with the AC:L/AT:N rating. Countervailing signals temper the urgency: no EPSS score was provided, the CVE is NOT on the CISA KEV list, and no public proof-of-concept is referenced, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The net picture is a high-risk, easily exploitable flaw that is a real patching priority for exposed QNAP NAS devices, but current telemetry shows opportunity rather than confirmed in-the-wild activity - absence of EPSS/KEV/POC data is a data gap, not proof of low risk.

A remote attacker who can reach a QNAP NAS running Video Station over the network sends a request that references another user's resource identifier (the user-controlled key), bypassing the authorization check and retrieving media metadata or content belonging to other users. Because the CVSS vector indicates no authentication (PR:N), no user interaction, and low attack complexity, the request can be issued directly against an internet-exposed or LAN-reachable instance. No public exploit code is currently identified, but CWE-639 flaws are generally simple to reproduce by enumerating object identifiers.