Notes Station 3 EUVD-2026-101983

Requires network reachability to a QNAP NAS that has the Notes Station 3 application installed and running (it is an optional add-on, not a default NAS service), at a version prior to 3.9.11. Per the vendor CVSS vector (PR:N/UI:N), no authentication or user interaction is needed, so default configurations of an installed, exposed instance are at risk. Limiting factors: the app must actually be installed and network-accessible, and the vendor's Low impact ratings (VC:L/VI:L/VA:L) suggest the injected commands run in a constrained context rather than yielding full root-level control; instances not exposed beyond a trusted LAN face reduced real-world risk.

Signals are mixed and should be weighed carefully. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a network-reachable, low-complexity, unauthenticated flaw - attributes that normally mark an urgent, scannable target. However, the same vector rates every impact as Low (VC:L/VI:L/VA:L) with no scope change, which is unusual for an OS command injection (CWE-78) that the description says allows attackers to 'execute arbitrary commands'; true arbitrary command execution would typically warrant High impacts. This tension suggests the achievable command context is constrained (limited privileges, sandboxed, or restricted command set), producing the moderate 6.9 base score rather than a critical one. No EPSS score, CISA KEV listing, POC reference, or SSVC decision data was provided, so exploitation probability and real-world activity cannot be quantified from the input. Net assessment: this is a genuine unauthenticated-RCE-class issue worth prioritized patching on exposed devices, but the vendor's Low impact ratings and the absence of any exploitation evidence argue against treating it as an emergency on par with a confirmed, high-impact KEV entry. Verify the actual command privilege/impact with QNAP before downgrading internally.

An attacker who can reach a QNAP NAS running Notes Station 3 over the network sends a crafted request to the vulnerable app endpoint, injecting shell metacharacters into a parameter that is passed to an OS command. Because the CVSS vector indicates no authentication or user interaction is required, this can be attempted directly against internet-exposed or LAN-reachable instances. No public exploit was identified at time of analysis, so exploitation would currently require independent vulnerability research.