QNAP HybridDesk Station CVE-2026-47786

Requires a network-reachable instance of QNAP HybridDesk Station (HD Station), the optional desktop/multimedia application add-on for QNAP NAS devices, running a version prior to 4.2.23 (4.2 branch) or 4.3.4 (4.3 branch). Per the vendor CVSS vector (AV:N/AC:L/PR:N/UI:N) no authentication, no user interaction, and no special attack prerequisites are needed against an affected installation. The practical limiting factor is that HybridDesk Station is an optional application that must be installed and running on the NAS, and exposure depends on whether its interface is reachable from the attacker's network position (LAN versus internet-facing); the exact vulnerable feature or input parameter is not disclosed in the available data.

This is a genuinely high-priority flaw. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes remote, low-complexity, unauthenticated exploitation with no user interaction, combined with full High impact to confidentiality, integrity, and availability (VC:H/VI:H/VA:H) - consistent with CWE-78 OS command injection yielding arbitrary command execution. All signals that ARE present point the same direction, with no internal contradiction between the vector and the description. However, several key exploitation signals are MISSING from the input: there is no EPSS probability provided, the vulnerability is NOT listed in CISA KEV, and no public proof-of-concept is referenced. Therefore the 9.3 score reflects intrinsic severity and ease of exploitation, not confirmed real-world exploitation volume - treat it as high patch priority on severity grounds while recognizing that active-exploitation and widespread-attack evidence is absent from the available data. The SSVC framework cannot be fully applied: exploitation status is 'none' from available data, automatable is plausible (no user interaction, network vector) but unconfirmed, and technical impact is total.

A remote, unauthenticated attacker reaches a network-exposed HybridDesk Station interface on a QNAP NAS and submits input that is unsafely passed to an OS shell, injecting attacker-controlled commands that execute on the device. No public exploit code is identified at time of analysis, but the low attack complexity and lack of required authentication or user interaction make reliable exploitation straightforward once the injection point is known.