License Center EUVD-2025-210098

Upgrade to QNAP License Center 1.9.56 or later, as confirmed by the vendor in advisory QSA-26-28 (https://www.qnap.com/en/security-advisory/qsa-26-28). Updates are typically applied via the QNAP App Center on the affected NAS device. As a compensating control while patching, restrict administrative access to License Center by limiting which accounts hold NAS administrator privileges and enabling multi-factor authentication for administrative login - reducing the likelihood that an attacker can acquire the high-privileged account required for exploitation. Blocking external network access to the NAS management interface (typically port 8080/8443) at the perimeter firewall further reduces exposure, though it does not eliminate risk from internal or already-authenticated attackers. No meaningful workaround exists that eliminates the traversal flaw itself without patching.