Notes Station 3
Monthly
QNAP Notes Station 3 versions prior to 3.9.11 fail to properly compartmentalize privileged functionality, so an attacker who already holds a local administrator account on the NAS can step outside the intended isolation boundary and compromise the confidentiality, integrity, and availability of the system. The vulnerability is strictly local (AV:L) and requires high privileges (PR:H) with no user interaction (UI:N), meaning it is not remotely reachable and cannot be triggered by an unauthenticated or low-privileged user; realistic abuse is limited to malicious privileged insiders or privilege/isolation escape following an earlier compromise. QNAP has released a fix in Notes Station 3 3.9.11 and later, and there is no public exploit code or CISA KEV entry identified at time of analysis, so this is a moderate-priority, high-barrier issue rather than an urgent widespread threat.
Incorrect permission assignment (CWE-732) in QNAP Notes Station 3 allows a local attacker who already holds a valid low-privileged account on the NAS to abuse an insecurely permissioned critical resource created by the application, resulting in full compromise of confidentiality, integrity, and availability of the affected system's data. Only QNAP NAS devices with the Notes Station 3 app installed are affected, and exploitation is not possible remotely by an unauthenticated attacker - it requires local access plus a user account (AV:L, PR:L per CVSS:4.0 vector and the assessed CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). No public exploit code has been identified at time of analysis, and EPSS/KEV data were not provided; QNAP has released a fix in Notes Station 3 3.9.11 and later.
Cross-site scripting in QNAP Notes Station 3 before 3.9.12 allows an attacker who already holds a valid Notes Station user account to inject malicious code that executes in a second user's browser session when that user views or interacts with the crafted content. Exploitation is not possible remotely without credentials (the assessed vector is PR:L), and it depends on a victim actively triggering the injected payload, so the resulting impact is confined to that victim's browser session - the QNAP NAS host and the Notes Station application itself suffer no direct confidentiality, integrity, or availability loss. No public exploit identified at time of analysis, and QNAP has shipped a fix in version 3.9.12.
QNAP Notes Station 3 versions prior to 3.9.11 contain an OS command injection flaw (CWE-78) that permits unauthenticated network attackers to run arbitrary commands on a NAS where the optional Notes Station 3 add-on is installed and reachable. The vendor's CVSS 4.0 vector (6.9) indicates low confidentiality, integrity, and availability impact, suggesting the injected commands execute in a constrained context rather than granting full system control. No public exploit code has been identified at time of analysis, and the primary exposure is limited to internet-facing or broadly accessible NAS instances running the vulnerable add-on.
An incorrect permission assignment for critical resource vulnerability has been reported to affect Notes Station 3. Rated high severity (CVSS 8.4). No vendor patch available.
A server-side request forgery (SSRF) vulnerability has been reported to affect Notes Station 3. Rated critical severity (CVSS 9.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
An OS command injection vulnerability has been reported to affect Notes Station 3. Rated high severity (CVSS 8.7), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A missing authentication for critical function vulnerability has been reported to affect Notes Station 3. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A cross-site scripting (XSS) vulnerability has been reported to affect Notes Station 3. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A cross-site scripting (XSS) vulnerability has been reported to affect Notes Station 3. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
QNAP Notes Station 3 versions prior to 3.9.11 fail to properly compartmentalize privileged functionality, so an attacker who already holds a local administrator account on the NAS can step outside the intended isolation boundary and compromise the confidentiality, integrity, and availability of the system. The vulnerability is strictly local (AV:L) and requires high privileges (PR:H) with no user interaction (UI:N), meaning it is not remotely reachable and cannot be triggered by an unauthenticated or low-privileged user; realistic abuse is limited to malicious privileged insiders or privilege/isolation escape following an earlier compromise. QNAP has released a fix in Notes Station 3 3.9.11 and later, and there is no public exploit code or CISA KEV entry identified at time of analysis, so this is a moderate-priority, high-barrier issue rather than an urgent widespread threat.
Incorrect permission assignment (CWE-732) in QNAP Notes Station 3 allows a local attacker who already holds a valid low-privileged account on the NAS to abuse an insecurely permissioned critical resource created by the application, resulting in full compromise of confidentiality, integrity, and availability of the affected system's data. Only QNAP NAS devices with the Notes Station 3 app installed are affected, and exploitation is not possible remotely by an unauthenticated attacker - it requires local access plus a user account (AV:L, PR:L per CVSS:4.0 vector and the assessed CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). No public exploit code has been identified at time of analysis, and EPSS/KEV data were not provided; QNAP has released a fix in Notes Station 3 3.9.11 and later.
Cross-site scripting in QNAP Notes Station 3 before 3.9.12 allows an attacker who already holds a valid Notes Station user account to inject malicious code that executes in a second user's browser session when that user views or interacts with the crafted content. Exploitation is not possible remotely without credentials (the assessed vector is PR:L), and it depends on a victim actively triggering the injected payload, so the resulting impact is confined to that victim's browser session - the QNAP NAS host and the Notes Station application itself suffer no direct confidentiality, integrity, or availability loss. No public exploit identified at time of analysis, and QNAP has shipped a fix in version 3.9.12.
QNAP Notes Station 3 versions prior to 3.9.11 contain an OS command injection flaw (CWE-78) that permits unauthenticated network attackers to run arbitrary commands on a NAS where the optional Notes Station 3 add-on is installed and reachable. The vendor's CVSS 4.0 vector (6.9) indicates low confidentiality, integrity, and availability impact, suggesting the injected commands execute in a constrained context rather than granting full system control. No public exploit code has been identified at time of analysis, and the primary exposure is limited to internet-facing or broadly accessible NAS instances running the vulnerable add-on.
An incorrect permission assignment for critical resource vulnerability has been reported to affect Notes Station 3. Rated high severity (CVSS 8.4). No vendor patch available.
A server-side request forgery (SSRF) vulnerability has been reported to affect Notes Station 3. Rated critical severity (CVSS 9.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
An OS command injection vulnerability has been reported to affect Notes Station 3. Rated high severity (CVSS 8.7), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A missing authentication for critical function vulnerability has been reported to affect Notes Station 3. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A cross-site scripting (XSS) vulnerability has been reported to affect Notes Station 3. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A cross-site scripting (XSS) vulnerability has been reported to affect Notes Station 3. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.