QuMagie EUVD-2026-35347

Network reachability to the QuMagie web service on a QNAP NAS running a version prior to 2.9.0 is the only firm prerequisite - the CVSS vector confirms no authentication (PR:N), no user interaction (UI:N), and no additional attack requirements (AT:N), so default deployments where QuMagie is installed and exposed are vulnerable. Exploitation is limited by whether the NAS web interface (typically port 8080/443 or via myQNAPcloud) is reachable from the attacker's network position, and by whether the QuMagie app is installed and enabled - QuMagie is an optional App Center package, so NAS devices without it installed are not affected. The specific vulnerable endpoint or API path is not disclosed in the QNAP advisory excerpt provided.

The CVSS 4.0 vector AV:N/AC:L/AT:N/PR:N/UI:N indicates a network-reachable, low-complexity, unauthenticated, no-user-interaction flaw, which is the worst-case exposure profile and supports the 8.7 score. However, only confidentiality is rated High (VC:H) while integrity and availability are None (VI:N/VA:N) - this conflicts with the vendor's description claiming attackers can both 'access unauthorized data' AND 'perform unauthorized actions,' since the latter would typically imply some integrity impact; defenders should verify with QNAP whether action execution is read-only enumeration or truly state-changing. No EPSS score, KEV listing, or POC reference was provided in the intelligence set, so there is no public exploit identified at time of analysis. NAS appliances exposed to the internet are historically high-value targets for QNAP-focused threat actors (e.g., DeadBolt, Qlocker campaigns), so despite no current KEV status, this should be treated as a high-priority patch for internet-facing deployments.

An attacker who can reach the QuMagie web interface on a QNAP NAS (directly exposed to the internet, via myQNAPcloud, or from a foothold on the LAN) sends crafted HTTP requests to QuMagie endpoints that lack proper authorization enforcement, retrieving private photos, album metadata, or invoking unauthorized API actions without supplying valid credentials. No public exploit identified at time of analysis, but the unauthenticated network attack vector and low complexity make weaponization straightforward once the affected endpoint is identified by reverse-engineering the patched 2.9.0 release.