Hybriddesk Station
Monthly
Unauthenticated remote command execution in QNAP HybridDesk Station (HD Station) lets network attackers run arbitrary operating system commands on affected QNAP NAS devices that have the optional desktop/multimedia add-on installed. The root cause is an OS command injection (CWE-78) rated 9.3 under CVSS v4.0 (AV:N/AC:L/PR:N/UI:N), so no credentials, user interaction, or special preconditions are required; the vendor has fixed it in HybridDesk Station 4.2.23 (4.2 branch) and 4.3.4 (4.3 branch). No public exploit code or confirmed active exploitation has been identified at time of analysis, but real-world risk is governed by whether HD Station is installed and whether its interface is reachable from the attacker's network position (LAN versus internet-facing), as the specific vulnerable feature and input parameter have not been disclosed.
QNAP HybridDesk Station (HD Station) before 4.2.22 contains a missing authentication flaw in a critical function, allowing unauthenticated attackers on an adjacent network to gain access to the system. Exploitation is constrained by a specific attack precondition and passive user interaction, and only QNAP NAS devices with the optional HD Station app installed and enabled are exposed. The vendor has released HybridDesk Station 4.2.22 and later as a fix; no public exploit was identified at time of analysis.
A command injection vulnerability has been reported to affect HybridDesk Station. Rated low severity (CVSS 2.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Unauthenticated remote command execution in QNAP HybridDesk Station (HD Station) lets network attackers run arbitrary operating system commands on affected QNAP NAS devices that have the optional desktop/multimedia add-on installed. The root cause is an OS command injection (CWE-78) rated 9.3 under CVSS v4.0 (AV:N/AC:L/PR:N/UI:N), so no credentials, user interaction, or special preconditions are required; the vendor has fixed it in HybridDesk Station 4.2.23 (4.2 branch) and 4.3.4 (4.3 branch). No public exploit code or confirmed active exploitation has been identified at time of analysis, but real-world risk is governed by whether HD Station is installed and whether its interface is reachable from the attacker's network position (LAN versus internet-facing), as the specific vulnerable feature and input parameter have not been disclosed.
QNAP HybridDesk Station (HD Station) before 4.2.22 contains a missing authentication flaw in a critical function, allowing unauthenticated attackers on an adjacent network to gain access to the system. Exploitation is constrained by a specific attack precondition and passive user interaction, and only QNAP NAS devices with the optional HD Station app installed and enabled are exposed. The vendor has released HybridDesk Station 4.2.22 and later as a fix; no public exploit was identified at time of analysis.
A command injection vulnerability has been reported to affect HybridDesk Station. Rated low severity (CVSS 2.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.