Qnap Systems Inc
Monthly
Path traversal in QNAP Qsirch lets remote attackers reach the full-text search application without authentication and read files and system data outside the intended directory structure on the host NAS. The vendor states the flaw is fixed in Qsirch 7.0.3.0 and later, so only NAS devices running an earlier build of this optional app - and exposing its web interface to the attacker's network path - remain at risk; no public exploit code and no confirmed active exploitation were identified at time of analysis. Our independent assessment scores the issue at CVSS 3.1 8.6-class severity on the confidentiality axis (C:H/I:N/A:N), meaning the realistic worst case is read-only disclosure of sensitive files rather than the file modification or service disruption implied by the higher input CVSS 4.0 score of 9.3.
Unauthenticated remote command execution in QNAP HybridDesk Station (HD Station) lets network attackers run arbitrary operating system commands on affected QNAP NAS devices that have the optional desktop/multimedia add-on installed. The root cause is an OS command injection (CWE-78) rated 9.3 under CVSS v4.0 (AV:N/AC:L/PR:N/UI:N), so no credentials, user interaction, or special preconditions are required; the vendor has fixed it in HybridDesk Station 4.2.23 (4.2 branch) and 4.3.4 (4.3 branch). No public exploit code or confirmed active exploitation has been identified at time of analysis, but real-world risk is governed by whether HD Station is installed and whether its interface is reachable from the attacker's network position (LAN versus internet-facing), as the specific vulnerable feature and input parameter have not been disclosed.
QNAP HybridDesk Station (HD Station) before 4.2.22 contains a missing authentication flaw in a critical function, allowing unauthenticated attackers on an adjacent network to gain access to the system. Exploitation is constrained by a specific attack precondition and passive user interaction, and only QNAP NAS devices with the optional HD Station app installed and enabled are exposed. The vendor has released HybridDesk Station 4.2.22 and later as a fix; no public exploit was identified at time of analysis.
QNAP Notes Station 3 versions prior to 3.9.11 fail to properly compartmentalize privileged functionality, so an attacker who already holds a local administrator account on the NAS can step outside the intended isolation boundary and compromise the confidentiality, integrity, and availability of the system. The vulnerability is strictly local (AV:L) and requires high privileges (PR:H) with no user interaction (UI:N), meaning it is not remotely reachable and cannot be triggered by an unauthenticated or low-privileged user; realistic abuse is limited to malicious privileged insiders or privilege/isolation escape following an earlier compromise. QNAP has released a fix in Notes Station 3 3.9.11 and later, and there is no public exploit code or CISA KEV entry identified at time of analysis, so this is a moderate-priority, high-barrier issue rather than an urgent widespread threat.
Incorrect permission assignment (CWE-732) in QNAP Notes Station 3 allows a local attacker who already holds a valid low-privileged account on the NAS to abuse an insecurely permissioned critical resource created by the application, resulting in full compromise of confidentiality, integrity, and availability of the affected system's data. Only QNAP NAS devices with the Notes Station 3 app installed are affected, and exploitation is not possible remotely by an unauthenticated attacker - it requires local access plus a user account (AV:L, PR:L per CVSS:4.0 vector and the assessed CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). No public exploit code has been identified at time of analysis, and EPSS/KEV data were not provided; QNAP has released a fix in Notes Station 3 3.9.11 and later.
Improper link resolution (CWE-59) in QNAP Virtualization Station before 4.1.1.130 allows an authenticated remote attacker with a low-privilege user account to manipulate a symbolic link that is later followed by a privileged file operation, achieving high confidentiality, integrity, and availability impact (CVSS 8.7). This is a credible, elevated-priority issue for environments running the Virtualization Station (QKVM) add-on, though not a drop-everything emergency; exploitation requires the app to be installed and the attacker to hold a valid low-privilege account, and no public exploit code or active exploitation (KEV) has been identified at time of analysis. Upgrade to 4.1.1.130 or later to remediate.
Authenticated remote attackers holding a valid QuMagie account can exploit a Unix symbolic-link following flaw (CWE-61) in QNAP's QuMagie photo and media management application to compromise the security of the underlying NAS system. The vulnerable code follows attacker-influenced symlinks during file operations, allowing file reads and writes outside the intended media library boundaries, with the assessed vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) reflecting high confidentiality, integrity and availability impact that crosses a security scope boundary - essentially escaping the application sandbox to reach the host NAS. Exploitation requires the attacker to first obtain a QuMagie user account (PR:L) and the ability to place a symlink or control a path the app will follow; no victim interaction is needed. There is no public exploit identified at time of analysis, and QNAP has released a fix in QuMagie 2.9.2 and later.
Unauthenticated remote attackers can read sensitive data from QNAP NAS devices running the optional Video Station (VideoStationPro) application prior to 5.8.8 by exploiting a CWE-639 authorization bypass through a user-controlled key. The vendor rates the flaw 8.7 under CVSS 4.0 (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N) and our independent assessment scores it 7.5 under CVSS 3.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), reflecting a confidentiality-only impact with no integrity or availability loss. Exploitation requires Video Station to be installed and network-reachable on a QTS/QuTS NAS, and no public exploit code or CISA KEV listing was identified at time of analysis, so this is a high-priority information-disclosure issue rather than a confirmed actively exploited one.
Authenticated path traversal in QNAP QuMagie lets an attacker who already holds a QuMagie administrator account read files and system data outside the intended media library on the underlying QNAP NAS. The flaw is remote, network-reachable and low-complexity, but the PR:H privilege requirement in the CVSS vector means it is not exploitable by anonymous users against default installations; no public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV. QNAP has shipped a fix in QuMagie 2.9.1 and later, so exposure is limited to NAS deployments still running older QuMagie builds and reachable by an admin-level account.
Authenticated path traversal in QNAP Video Station before 5.8.8 allows a remote attacker with a valid low-privileged user account to read arbitrary files and system data outside the intended application directory. The flaw is CWE-22 and requires network access with low complexity and no user interaction, but the PR:L vector means an attacker must first hold a Video Station account, limiting mass exploitation. no public exploit identified at time of analysis, and QNAP has released Video Station 5.8.8 as the fix. The vendor CVSS 4.0 score is 8.7, but independent assessment scopes impact to confidentiality only, so it is a genuine moderate-priority issue rather than a top-tier emergency.
Incorrect permission assignment in QNAP Download Station (all builds prior to 5.10.1.312 or 5.11.2.321) lets a local attacker who already holds an administrator account on the NAS escalate that foothold into full compromise of the device's confidentiality, integrity and availability. The issue is access-gated rather than remotely reachable: the CVSS:4.0 vector marks local attack vector (AV:L) and high privileges (PR:H), so a remote or unauthenticated attacker cannot trigger it and no user interaction is required once admin access exists. No public exploit code has been identified at time of analysis and the flaw is not confirmed as actively exploited (CISA KEV), but vendor-released fixes are available, so the practical risk sits with deployments that share, weakly protect, or already have compromised QNAP admin credentials.
Missing authentication in sMedio DTCP MOVE before version 1.4.5 lets remote, unauthenticated attackers reach critical functions of the DTCP-IP content-transfer service (sMedioDTCPServer) running on QNAP NAS devices, yielding high impact to confidentiality, integrity and availability (vendor CVSS 4.0 base 9.3; independent assessment CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). The vendor has shipped a fixed release (1.4.5 and later), and no public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis. Real-world exposure is limited mainly by deployment scarcity - this is an optional, niche QNAP add-on rather than a default NAS service - and by whether the affected service is network-reachable rather than confined behind NAT or a segmented LAN.
SQL injection in QNAP Video Station before version 5.8.8 lets a remote attacker who already holds a valid Video Station user account inject arbitrary SQL into the application's database queries, exposing stored data with high confidentiality impact and a limited availability effect. The vendor-reported vector (CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L, 7.1) and our independent assessment (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L) agree that the vulnerability is network-reachable, low complexity and requires no user interaction, but that the attacker must first authenticate as a Video Station user - this authentication prerequisite is the main limiting factor and rules out fully unauthenticated internet exploitation. There is no public exploit identified at time of analysis, and QNAP has already shipped a fix in Video Station 5.8.8 and later, so risk is highest for NAS devices that expose Video Station to untrusted networks and provision multiple or guest-level accounts.
SQL injection in QNAP Video Station (versions prior to 5.8.8) allows a remote attacker who already holds a valid NAS user account to read sensitive data from the application's backend database through the Video Station web interface. The flaw is an authenticated issue (CVSS PR:L), and the independent assessment bounds the impact to confidentiality only (C:H), meaning it does not by itself provide code execution or service disruption despite the description's broader wording. No public exploit code was identified at time of analysis, and the vendor has released a fix in Video Station 5.8.8 and later.
Path traversal in QNAP Qsync Central allows an attacker who already holds a valid Qsync Central user account to read files and system data outside the intended directory scope on the NAS. The flaw originates from improper limitation of a pathname to a restricted directory (CWE-22); because the CVSS vector specifies PR:L, exploitation is authenticated - remote unauthenticated Internet attackers cannot reach it against default configurations. Impact is assessed as information disclosure of high confidentiality value rather than code execution or data destruction, and no public exploit code has been identified at time of analysis. All versions prior to Qsync Central 5.0.0.6, 5.1.0.2, and 5.2.0.4 are affected, and QNAP has released fixed builds on each of these branches.
Authenticated command injection in QNAP QTS and QuTS hero NAS operating systems allows attackers with administrator credentials to execute arbitrary OS commands on the appliance. The flaw spans multiple QTS and QuTS hero release trains (5.2.x, 5.3.x, and 6.0.x) and has been patched by QNAP across all affected branches. No public exploit identified at time of analysis, and the vulnerability is not currently listed in CISA KEV, but the post-authentication code execution primitive is highly valuable for attackers who have already harvested admin credentials.
Authorization bypass in QNAP QuMagie versions prior to 2.9.1 allows remote unauthenticated attackers to manipulate user-controlled keys (IDOR-class flaw) and gain unintended privileges on the photo management application. The QNAP-issued advisory QSA-26-35 confirms the issue and ships a fix in 2.9.1; no public exploit identified at time of analysis, and the flaw is not currently listed in CISA KEV.
Remote command execution in QuNetSwitch versions prior to 2.0.4.0415 allows unauthenticated attackers to execute arbitrary system commands over the network with no user interaction required. The vulnerability stems from improper input validation in command processing functions, enabling complete system compromise. No patch is currently available for affected versions.
QVR Pro contains a missing authentication vulnerability (CWE-306) that allows remote attackers to access critical functions without proper credential validation, potentially gaining unauthorized system access. All versions prior to QVR Pro 2.7.4.14 are affected. This authentication bypass vulnerability enables unauthenticated remote exploitation of a surveillance management platform, representing a direct threat to organizations relying on QVR Pro for video recording and system administration.
Hard-coded cryptographic key use in QNAP HBS 3 Hybrid Backup Sync lets a network-adjacent, unauthenticated attacker compromise the confidentiality, integrity and availability of the NAS. Installations running HBS 3 Hybrid Backup Sync below 26.4.0.521, or Hybrid Backup Sync below 26.4.0.521 / 26.4.1.563, are affected; because the key ships inside the software it is identical on every install and recoverable from the package, so no credentials or user interaction are needed. There is no public exploit identified at time of analysis, but the vendor has released fixed builds and the exposure is rated 8.7 (CVSS 4.0) with high impact across all three pillars.
A hard-coded cryptographic key (CWE-321) in QNAP's HBS 3 Hybrid Backup Sync and Hybrid Backup Sync leaves affected NAS appliances protected by a static secret that is identical across installations. Unauthenticated attackers positioned on the same local or logical network segment (CVSS AV:A) can leverage the key to fully compromise confidentiality, integrity and availability of the backup application and, by extension, the system security it protects; no user interaction and no credentials are required. QNAP has released fixed builds, and while no public exploit code or confirmed active exploitation was identified at time of analysis, the static nature of the key means a single recovery of the secret applies to every unpatched device.
Authenticated cross-site scripting in QNAP's QuFTP Service allows a remote attacker who already holds a valid QuFTP user account to inject malicious script that executes in a victim's browser within the NAS web interface, potentially compromising the wider session context rather than the FTP service alone. The flaw affects QuFTP Service installations on QNAP NAS devices in branches prior to 1.4.6, 1.5.5, and 1.6.5, and successful exploitation additionally requires a victim to view the injected content. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the mandatory account prerequisite plus the user-interaction requirement are the principal limiters on real-world risk.
Cross-site scripting in QNAP Notes Station 3 before 3.9.12 allows an attacker who already holds a valid Notes Station user account to inject malicious code that executes in a second user's browser session when that user views or interacts with the crafted content. Exploitation is not possible remotely without credentials (the assessed vector is PR:L), and it depends on a victim actively triggering the injected payload, so the resulting impact is confined to that victim's browser session - the QNAP NAS host and the Notes Station application itself suffer no direct confidentiality, integrity, or availability loss. No public exploit identified at time of analysis, and QNAP has shipped a fix in version 3.9.12.
QNAP Notes Station 3 versions prior to 3.9.11 contain an OS command injection flaw (CWE-78) that permits unauthenticated network attackers to run arbitrary commands on a NAS where the optional Notes Station 3 add-on is installed and reachable. The vendor's CVSS 4.0 vector (6.9) indicates low confidentiality, integrity, and availability impact, suggesting the injected commands execute in a constrained context rather than granting full system control. No public exploit code has been identified at time of analysis, and the primary exposure is limited to internet-facing or broadly accessible NAS instances running the vulnerable add-on.
Authenticated remote attackers with a valid Qsync Central user account can exploit a unix symbolic link (symlink) following vulnerability (CWE-61) in QNAP Qsync Central to compromise system security, potentially leading to low impact on confidentiality, integrity, and availability. Affected versions are Qsync Central prior to 5.0.0.7, 5.1.0.3, 5.2.0.5, and 5.3.0.2. This medium-severity issue (CVSS 4.0 base 5.3) has no public exploit identified at time of analysis and requires the attacker to first obtain a valid account on the NAS.
Server-side request forgery in QNAP Download Station allows a low-privileged authenticated user to make the NAS application issue requests to internal or arbitrary destinations, resulting in limited disclosure of application data rather than any modification or denial of service. The flaw affects Download Station builds before 5.10.1.312 and the 5.11.x line before 5.11.2.321, and QNAP has published fixed versions for each branch. The issue is authentication-gated (CVSS 4.0 base 5.3, PR:L, confidentiality-only; independent assessment restricts impact to VC:L/VI:N/VA:N), and no public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis.
NULL pointer dereference in QNAP Qsync Central allows an authenticated remote user to cause a denial-of-service (DoS) condition that crashes the Qsync Central service. Exploitation requires the attacker to first obtain a valid Qsync Central / NAS user account, and the resulting crash is recoverable, affecting only the Qsync Central service rather than the entire NAS. No public exploit code has been identified at the time of analysis; the vendor has released a fix in Qsync Central 5.0.0.4 and later.
Authorization bypass in QNAP File Station 5 (versions 5.5.0 through 5.5.6.5243) allows a remote attacker with a valid low-privileged user account to circumvent intended access restrictions and reach files or operations they should not be able to access. The flaw was reported by QNAP itself with a CVSS 4.0 score of 8.6 reflecting high confidentiality and integrity impact, and there is no public exploit identified at time of analysis. Note that the vendor description text references 'File Station 6,' but the CPE, affected version list, and fix data all point to File Station 5, which appears to be a typo in the advisory.
Stack-based buffer overflow in QNAP File Station 5 versions 5.5.0 through 5.5.6.5208 allows authenticated remote attackers to corrupt memory and crash processes on affected NAS deployments. CVSS 4.0 score of 8.7 reflects high impact across confidentiality, integrity, and availability, though exploitation requires valid user credentials (PR:L). No public exploit identified at time of analysis, and the CVE is not currently listed in CISA KEV.
Unauthorized data access and action execution in QNAP QuMagie versions prior to 2.9.0 allows remote attackers to bypass authorization checks and interact with resources they should not be permitted to reach. The flaw is classified as a missing authorization issue (CWE-862) and carries a CVSS 4.0 score of 8.7 due to its network-reachable, low-complexity nature with no privileges or user interaction required. No public exploit identified at time of analysis, but QNAP NAS appliances are historically high-value targets for opportunistic attackers.
Authenticated command injection in QNAP QTS and QuTS hero NAS operating systems allows an attacker who already holds an administrator account to execute arbitrary OS commands on the appliance. The flaw carries a CVSS 4.0 score of 8.6, but the PR:H requirement substantially narrows the attacker population; no public exploit identified at time of analysis and the issue is not listed in CISA KEV. QNAP has shipped fixed builds (QTS 5.2.9.3492 build 20260507 and QuTS hero h5.2.9.3499 build 20260514).
Path traversal in QNAP QTS and QuTS hero NAS operating systems exposes arbitrary file contents to attackers who have already obtained administrator-level access. The root cause (CWE-22) indicates insufficient sanitization of file path inputs, allowing directory escape to reach files outside intended scope. No public exploit code has been identified at time of analysis, and CISA KEV lists no active exploitation - making this a targeted post-compromise risk rather than an opportunistic mass-exploitation scenario. Vendor-released patches address all affected branches as of May 2026.
NULL pointer dereference in QNAP QTS and QuTS hero NAS operating systems enables a remote, administrator-authenticated attacker to trigger a denial-of-service condition. Exploitation requires the attacker to first hold or acquire an administrator account on the target device, after which a crafted request can crash system services. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog at time of analysis.
Resource exhaustion in QNAP File Station 5 (versions 5.5.0 through 5.5.6.5242) allows a remote attacker holding a low-privilege user account to exhaust shared resources, denying availability to other users, processes, or applications on the same system. The vulnerability is classified as a Denial-of-Service risk with no impact on confidentiality or data integrity. No public exploit code or CISA KEV listing has been identified at time of analysis; QNAP has released a patched version and published a security advisory.
NULL pointer dereference in QNAP File Station 5 enables authenticated remote attackers to crash the service and cause a denial-of-service condition. Exploitation requires prior acquisition of a valid user account on the target QNAP NAS device, after which the attacker can trigger the dereference remotely over the network. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
NULL pointer dereference in QNAP QTS and QuTS hero NAS operating systems allows remote unauthenticated attackers to crash a network-facing service and cause a denial-of-service condition without any authentication or user interaction. Multiple active OS branches are affected - QTS 5.2.x and QuTS hero h5.2.x through h6.0.x - across a device population that is historically internet-exposed and frequently targeted. No public exploit has been identified and this vulnerability is not listed in CISA KEV, but the zero-authentication, network-accessible attack surface makes DoS attempts trivially repeatable against unpatched devices.
Integer overflow (CWE-190) in QNAP QTS and QuTS hero NAS operating systems allows a remote attacker who has already obtained an administrator account to further compromise system integrity and availability. Affected versions span QTS 5.2.x and QuTS hero h5.2.x through h6.0.x; QNAP released patched builds in February and May 2026. No public exploit code and no CISA KEV listing have been identified at time of analysis, and the mandatory prerequisite of administrator-level access materially constrains real-world exploitability.
Authenticated command injection in QNAP QTS and QuTS hero allows a remote attacker holding administrator credentials to execute arbitrary OS commands on the NAS appliance. The CVSS 4.0 base score of 8.6 reflects high impact across confidentiality, integrity, and availability, though exploitation requires high privileges (PR:H). No public exploit has been identified at time of analysis, and the issue is not listed in CISA KEV; QNAP has released fixed builds across affected QTS and QuTS hero branches.
Authenticated command injection in QNAP QTS and QuTS hero NAS operating systems allows a remote attacker who has already obtained administrator credentials to execute arbitrary OS commands on the appliance. Reported by QNAP itself and tracked as EUVD-2025-210099, the issue affects multiple branches across QTS 5.2.x and QuTS hero 5.2.x, 5.3.x, and 6.0.x and is fixed in builds dated 2026-02-06 through 2026-05-20. No public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Path traversal in QNAP License Center (versions 1.9.0 through 1.9.55) permits a high-privileged attacker with an administrator account to read arbitrary files or system data outside the intended directory scope. The CVSS 4.0 vector (AV:N/PR:H) indicates network-reachable exploitation contingent on first obtaining administrative credentials. No public exploit code or active exploitation has been identified at time of analysis; a vendor-released patch is available in version 1.9.56.
NULL pointer dereference in QNAP QuTS hero NAS operating system allows a remote attacker who has already obtained or possesses an administrator account to trigger a denial-of-service condition, crashing affected services. Affected branches span QuTS hero h5.2.x, h5.3.x, and h6.0.x series, with vendor-released patches available as of early-to-mid 2026. No public exploit code or CISA KEV listing has been identified at time of analysis, and the mandatory prerequisite of high-privilege authentication substantially constrains real-world impact.
Cross-site request forgery in QNAP Notification Center allows remote unauthenticated attackers to forge state-changing requests on behalf of authenticated NAS users, potentially resulting in privilege escalation or session hijacking within the Notification Center context. Affected versions are all Notification Center 1.10.0 builds prior to 1.10.0.3291, confirmed by QNAP advisory QSA-26-13 and EUVD-2025-210096. Exploitation requires active victim interaction (CVSS 4.0 UI:A), integrity impact is rated low (VI:L), and no public exploit code or active exploitation has been identified at time of analysis.
External control of assumed-immutable web parameters in QNAP NAS software enables remote unauthenticated attackers to achieve low-integrity impact by manipulating parameters the application treats as unmodifiable. The vulnerability requires active user interaction to trigger, limiting opportunistic exploitation. QNAP has released a fix per advisory QSA-26-10; no public exploit code or CISA KEV listing has been identified at time of analysis.
High-severity information disclosure flaw in QNAP QTS NAS operating system versions 5.2.0 through 5.2.7.3256 build 20250913 allows remote unauthenticated attackers to obtain sensitive data over the network with low attack complexity, per CVSS v4.0 vector AV:N/AC:L/PR:N/UI:N rating 9.2. The vendor has released a fix, and notably QuTS hero is explicitly unaffected. No public exploit identified at time of analysis, and the issue is not currently listed in CISA KEV.
Stack-based buffer overflow in QNAP QTS and QuTS hero NAS operating systems enables an authenticated administrator to corrupt stack memory or crash processes via a network-accessible attack path. Affected versions span QTS 5.2.x and multiple QuTS hero release trains (h5.2.x, h5.3.x, h6.0.x), with vendor-released patches dated February-May 2026. No public exploit code and no CISA KEV listing have been identified at time of analysis, and the mandatory high-privilege prerequisite substantially limits realistic attack surface.
Unauthorized data access and action execution in QNAP QuMagie versions prior to 2.9.0 allows remote attackers to bypass authorization checks over the network without authentication. The CVSS 4.0 score of 8.7 reflects high confidentiality impact with low attack complexity and no privileges required, though no public exploit identified at time of analysis and KEV listing is absent.
A stack-based buffer overflow vulnerability exists in QNAP Media Streaming Add-On that allows remote attackers to corrupt memory or crash the affected process. All versions prior to 500.1.1 are vulnerable, and the attack requires no authentication or user interaction. While no CVSS score or EPSS data is currently available, the presence of a confirmed patch and the critical nature of buffer overflow vulnerabilities in media processing software suggests this warrants immediate patching.
An improper restriction of communication channel to intended endpoints vulnerability (CWE-923) has been identified in QNAP QHora devices, allowing attackers with physical access to exploit insufficient endpoint validation and gain privileges intended for legitimate endpoints. The vulnerability affects QHora/QuRouter products prior to version 2.6.3.009. While no CVSS score or EPSS data is currently available and the vulnerability does not appear in active exploitation databases (KEV), the physical access requirement significantly constrains real-world exploitability, though the privilege escalation impact remains concerning for organizations with physical security controls.
A weak authentication vulnerability exists in QNAP QHora/QuRouter devices that allows attackers with local network access to bypass authentication mechanisms and disclose sensitive information. The vulnerability affects QuRouter versions prior to 2.6.2.007, and exploitation requires network-level access but no special privileges. While no CVSS score or EPSS data is publicly available, the classification as CWE-1390 (Weak Authentication) and the emphasis on local network access indicates this is a network-adjacent threat with moderate real-world risk, particularly in environments where untrusted devices can connect to the local network.
An improper neutralization of escape, meta, or control sequences vulnerability (CWE-150) affects QNAP QHora/QuRouter devices, allowing local attackers with administrator privileges to cause unexpected behavior through injection of unfiltered control sequences. The vulnerability has been patched in QuRouter version 2.6.3.009 and later. While no CVSS score, EPSS probability, or KEV/POC data are currently published, the requirement for local administrator access significantly limits exploitation scope in typical deployments.
An SQL injection vulnerability exists in QNAP QuRouter that allows authenticated local administrators to execute unauthorized code or commands through SQL injection techniques. The vulnerability affects QuRouter versions prior to 2.6.2.007, and exploitation requires an attacker to first obtain legitimate administrator credentials on the affected device. While no CVSS score or EPSS data is currently published, the SQL injection classification (CWE-89) combined with code execution impact represents a critical risk for compromised administrator accounts.
A cross-site scripting (XSS) vulnerability exists in QuFTP Service that allows authenticated remote attackers with administrator credentials to bypass security mechanisms and read application data. The vulnerability affects multiple versions of QuFTP Service across different release branches (1.4.x, 1.5.x, and 1.6.x prior to specified patch versions). While no CVSS score, EPSS probability, or KEV status is currently available, the requirement for administrator-level access significantly constrains real-world exploitation risk.
QuNetSwitch contains hard-coded credentials that allow remote attackers to bypass authentication and gain unauthorized access to affected systems. This vulnerability affects QuNetSwitch versions prior to 2.0.5.0906, where credentials are embedded in the application code rather than properly managed through secure credential storage mechanisms. Remote attackers can exploit this weakness without requiring valid user credentials, leading to complete compromise of the network switch management interface.
Command injection in QuNetSwitch allows authenticated remote attackers to execute arbitrary commands on affected systems with high impact to confidentiality and integrity. The vulnerability requires valid user credentials to exploit but poses significant risk to systems running versions prior to 2.0.5.0906. No patch is currently available for this CVSS 6.3 medium-severity issue.
Arbitrary command execution in QuNetSwitch can be achieved by local attackers with administrator privileges due to insufficient input validation in command processing. This vulnerability affects QuNetSwitch versions prior to 2.0.5.0906, allowing authenticated high-privilege users to bypass security controls and execute system commands. No patch is currently available for affected versions.
Path traversal in QNAP Qsirch lets remote attackers reach the full-text search application without authentication and read files and system data outside the intended directory structure on the host NAS. The vendor states the flaw is fixed in Qsirch 7.0.3.0 and later, so only NAS devices running an earlier build of this optional app - and exposing its web interface to the attacker's network path - remain at risk; no public exploit code and no confirmed active exploitation were identified at time of analysis. Our independent assessment scores the issue at CVSS 3.1 8.6-class severity on the confidentiality axis (C:H/I:N/A:N), meaning the realistic worst case is read-only disclosure of sensitive files rather than the file modification or service disruption implied by the higher input CVSS 4.0 score of 9.3.
Unauthenticated remote command execution in QNAP HybridDesk Station (HD Station) lets network attackers run arbitrary operating system commands on affected QNAP NAS devices that have the optional desktop/multimedia add-on installed. The root cause is an OS command injection (CWE-78) rated 9.3 under CVSS v4.0 (AV:N/AC:L/PR:N/UI:N), so no credentials, user interaction, or special preconditions are required; the vendor has fixed it in HybridDesk Station 4.2.23 (4.2 branch) and 4.3.4 (4.3 branch). No public exploit code or confirmed active exploitation has been identified at time of analysis, but real-world risk is governed by whether HD Station is installed and whether its interface is reachable from the attacker's network position (LAN versus internet-facing), as the specific vulnerable feature and input parameter have not been disclosed.
QNAP HybridDesk Station (HD Station) before 4.2.22 contains a missing authentication flaw in a critical function, allowing unauthenticated attackers on an adjacent network to gain access to the system. Exploitation is constrained by a specific attack precondition and passive user interaction, and only QNAP NAS devices with the optional HD Station app installed and enabled are exposed. The vendor has released HybridDesk Station 4.2.22 and later as a fix; no public exploit was identified at time of analysis.
QNAP Notes Station 3 versions prior to 3.9.11 fail to properly compartmentalize privileged functionality, so an attacker who already holds a local administrator account on the NAS can step outside the intended isolation boundary and compromise the confidentiality, integrity, and availability of the system. The vulnerability is strictly local (AV:L) and requires high privileges (PR:H) with no user interaction (UI:N), meaning it is not remotely reachable and cannot be triggered by an unauthenticated or low-privileged user; realistic abuse is limited to malicious privileged insiders or privilege/isolation escape following an earlier compromise. QNAP has released a fix in Notes Station 3 3.9.11 and later, and there is no public exploit code or CISA KEV entry identified at time of analysis, so this is a moderate-priority, high-barrier issue rather than an urgent widespread threat.
Incorrect permission assignment (CWE-732) in QNAP Notes Station 3 allows a local attacker who already holds a valid low-privileged account on the NAS to abuse an insecurely permissioned critical resource created by the application, resulting in full compromise of confidentiality, integrity, and availability of the affected system's data. Only QNAP NAS devices with the Notes Station 3 app installed are affected, and exploitation is not possible remotely by an unauthenticated attacker - it requires local access plus a user account (AV:L, PR:L per CVSS:4.0 vector and the assessed CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). No public exploit code has been identified at time of analysis, and EPSS/KEV data were not provided; QNAP has released a fix in Notes Station 3 3.9.11 and later.
Improper link resolution (CWE-59) in QNAP Virtualization Station before 4.1.1.130 allows an authenticated remote attacker with a low-privilege user account to manipulate a symbolic link that is later followed by a privileged file operation, achieving high confidentiality, integrity, and availability impact (CVSS 8.7). This is a credible, elevated-priority issue for environments running the Virtualization Station (QKVM) add-on, though not a drop-everything emergency; exploitation requires the app to be installed and the attacker to hold a valid low-privilege account, and no public exploit code or active exploitation (KEV) has been identified at time of analysis. Upgrade to 4.1.1.130 or later to remediate.
Authenticated remote attackers holding a valid QuMagie account can exploit a Unix symbolic-link following flaw (CWE-61) in QNAP's QuMagie photo and media management application to compromise the security of the underlying NAS system. The vulnerable code follows attacker-influenced symlinks during file operations, allowing file reads and writes outside the intended media library boundaries, with the assessed vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) reflecting high confidentiality, integrity and availability impact that crosses a security scope boundary - essentially escaping the application sandbox to reach the host NAS. Exploitation requires the attacker to first obtain a QuMagie user account (PR:L) and the ability to place a symlink or control a path the app will follow; no victim interaction is needed. There is no public exploit identified at time of analysis, and QNAP has released a fix in QuMagie 2.9.2 and later.
Unauthenticated remote attackers can read sensitive data from QNAP NAS devices running the optional Video Station (VideoStationPro) application prior to 5.8.8 by exploiting a CWE-639 authorization bypass through a user-controlled key. The vendor rates the flaw 8.7 under CVSS 4.0 (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N) and our independent assessment scores it 7.5 under CVSS 3.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), reflecting a confidentiality-only impact with no integrity or availability loss. Exploitation requires Video Station to be installed and network-reachable on a QTS/QuTS NAS, and no public exploit code or CISA KEV listing was identified at time of analysis, so this is a high-priority information-disclosure issue rather than a confirmed actively exploited one.
Authenticated path traversal in QNAP QuMagie lets an attacker who already holds a QuMagie administrator account read files and system data outside the intended media library on the underlying QNAP NAS. The flaw is remote, network-reachable and low-complexity, but the PR:H privilege requirement in the CVSS vector means it is not exploitable by anonymous users against default installations; no public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV. QNAP has shipped a fix in QuMagie 2.9.1 and later, so exposure is limited to NAS deployments still running older QuMagie builds and reachable by an admin-level account.
Authenticated path traversal in QNAP Video Station before 5.8.8 allows a remote attacker with a valid low-privileged user account to read arbitrary files and system data outside the intended application directory. The flaw is CWE-22 and requires network access with low complexity and no user interaction, but the PR:L vector means an attacker must first hold a Video Station account, limiting mass exploitation. no public exploit identified at time of analysis, and QNAP has released Video Station 5.8.8 as the fix. The vendor CVSS 4.0 score is 8.7, but independent assessment scopes impact to confidentiality only, so it is a genuine moderate-priority issue rather than a top-tier emergency.
Incorrect permission assignment in QNAP Download Station (all builds prior to 5.10.1.312 or 5.11.2.321) lets a local attacker who already holds an administrator account on the NAS escalate that foothold into full compromise of the device's confidentiality, integrity and availability. The issue is access-gated rather than remotely reachable: the CVSS:4.0 vector marks local attack vector (AV:L) and high privileges (PR:H), so a remote or unauthenticated attacker cannot trigger it and no user interaction is required once admin access exists. No public exploit code has been identified at time of analysis and the flaw is not confirmed as actively exploited (CISA KEV), but vendor-released fixes are available, so the practical risk sits with deployments that share, weakly protect, or already have compromised QNAP admin credentials.
Missing authentication in sMedio DTCP MOVE before version 1.4.5 lets remote, unauthenticated attackers reach critical functions of the DTCP-IP content-transfer service (sMedioDTCPServer) running on QNAP NAS devices, yielding high impact to confidentiality, integrity and availability (vendor CVSS 4.0 base 9.3; independent assessment CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). The vendor has shipped a fixed release (1.4.5 and later), and no public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis. Real-world exposure is limited mainly by deployment scarcity - this is an optional, niche QNAP add-on rather than a default NAS service - and by whether the affected service is network-reachable rather than confined behind NAT or a segmented LAN.
SQL injection in QNAP Video Station before version 5.8.8 lets a remote attacker who already holds a valid Video Station user account inject arbitrary SQL into the application's database queries, exposing stored data with high confidentiality impact and a limited availability effect. The vendor-reported vector (CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L, 7.1) and our independent assessment (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L) agree that the vulnerability is network-reachable, low complexity and requires no user interaction, but that the attacker must first authenticate as a Video Station user - this authentication prerequisite is the main limiting factor and rules out fully unauthenticated internet exploitation. There is no public exploit identified at time of analysis, and QNAP has already shipped a fix in Video Station 5.8.8 and later, so risk is highest for NAS devices that expose Video Station to untrusted networks and provision multiple or guest-level accounts.
SQL injection in QNAP Video Station (versions prior to 5.8.8) allows a remote attacker who already holds a valid NAS user account to read sensitive data from the application's backend database through the Video Station web interface. The flaw is an authenticated issue (CVSS PR:L), and the independent assessment bounds the impact to confidentiality only (C:H), meaning it does not by itself provide code execution or service disruption despite the description's broader wording. No public exploit code was identified at time of analysis, and the vendor has released a fix in Video Station 5.8.8 and later.
Path traversal in QNAP Qsync Central allows an attacker who already holds a valid Qsync Central user account to read files and system data outside the intended directory scope on the NAS. The flaw originates from improper limitation of a pathname to a restricted directory (CWE-22); because the CVSS vector specifies PR:L, exploitation is authenticated - remote unauthenticated Internet attackers cannot reach it against default configurations. Impact is assessed as information disclosure of high confidentiality value rather than code execution or data destruction, and no public exploit code has been identified at time of analysis. All versions prior to Qsync Central 5.0.0.6, 5.1.0.2, and 5.2.0.4 are affected, and QNAP has released fixed builds on each of these branches.
Authenticated command injection in QNAP QTS and QuTS hero NAS operating systems allows attackers with administrator credentials to execute arbitrary OS commands on the appliance. The flaw spans multiple QTS and QuTS hero release trains (5.2.x, 5.3.x, and 6.0.x) and has been patched by QNAP across all affected branches. No public exploit identified at time of analysis, and the vulnerability is not currently listed in CISA KEV, but the post-authentication code execution primitive is highly valuable for attackers who have already harvested admin credentials.
Authorization bypass in QNAP QuMagie versions prior to 2.9.1 allows remote unauthenticated attackers to manipulate user-controlled keys (IDOR-class flaw) and gain unintended privileges on the photo management application. The QNAP-issued advisory QSA-26-35 confirms the issue and ships a fix in 2.9.1; no public exploit identified at time of analysis, and the flaw is not currently listed in CISA KEV.
Remote command execution in QuNetSwitch versions prior to 2.0.4.0415 allows unauthenticated attackers to execute arbitrary system commands over the network with no user interaction required. The vulnerability stems from improper input validation in command processing functions, enabling complete system compromise. No patch is currently available for affected versions.
QVR Pro contains a missing authentication vulnerability (CWE-306) that allows remote attackers to access critical functions without proper credential validation, potentially gaining unauthorized system access. All versions prior to QVR Pro 2.7.4.14 are affected. This authentication bypass vulnerability enables unauthenticated remote exploitation of a surveillance management platform, representing a direct threat to organizations relying on QVR Pro for video recording and system administration.
Hard-coded cryptographic key use in QNAP HBS 3 Hybrid Backup Sync lets a network-adjacent, unauthenticated attacker compromise the confidentiality, integrity and availability of the NAS. Installations running HBS 3 Hybrid Backup Sync below 26.4.0.521, or Hybrid Backup Sync below 26.4.0.521 / 26.4.1.563, are affected; because the key ships inside the software it is identical on every install and recoverable from the package, so no credentials or user interaction are needed. There is no public exploit identified at time of analysis, but the vendor has released fixed builds and the exposure is rated 8.7 (CVSS 4.0) with high impact across all three pillars.
A hard-coded cryptographic key (CWE-321) in QNAP's HBS 3 Hybrid Backup Sync and Hybrid Backup Sync leaves affected NAS appliances protected by a static secret that is identical across installations. Unauthenticated attackers positioned on the same local or logical network segment (CVSS AV:A) can leverage the key to fully compromise confidentiality, integrity and availability of the backup application and, by extension, the system security it protects; no user interaction and no credentials are required. QNAP has released fixed builds, and while no public exploit code or confirmed active exploitation was identified at time of analysis, the static nature of the key means a single recovery of the secret applies to every unpatched device.
Authenticated cross-site scripting in QNAP's QuFTP Service allows a remote attacker who already holds a valid QuFTP user account to inject malicious script that executes in a victim's browser within the NAS web interface, potentially compromising the wider session context rather than the FTP service alone. The flaw affects QuFTP Service installations on QNAP NAS devices in branches prior to 1.4.6, 1.5.5, and 1.6.5, and successful exploitation additionally requires a victim to view the injected content. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the mandatory account prerequisite plus the user-interaction requirement are the principal limiters on real-world risk.
Cross-site scripting in QNAP Notes Station 3 before 3.9.12 allows an attacker who already holds a valid Notes Station user account to inject malicious code that executes in a second user's browser session when that user views or interacts with the crafted content. Exploitation is not possible remotely without credentials (the assessed vector is PR:L), and it depends on a victim actively triggering the injected payload, so the resulting impact is confined to that victim's browser session - the QNAP NAS host and the Notes Station application itself suffer no direct confidentiality, integrity, or availability loss. No public exploit identified at time of analysis, and QNAP has shipped a fix in version 3.9.12.
QNAP Notes Station 3 versions prior to 3.9.11 contain an OS command injection flaw (CWE-78) that permits unauthenticated network attackers to run arbitrary commands on a NAS where the optional Notes Station 3 add-on is installed and reachable. The vendor's CVSS 4.0 vector (6.9) indicates low confidentiality, integrity, and availability impact, suggesting the injected commands execute in a constrained context rather than granting full system control. No public exploit code has been identified at time of analysis, and the primary exposure is limited to internet-facing or broadly accessible NAS instances running the vulnerable add-on.
Authenticated remote attackers with a valid Qsync Central user account can exploit a unix symbolic link (symlink) following vulnerability (CWE-61) in QNAP Qsync Central to compromise system security, potentially leading to low impact on confidentiality, integrity, and availability. Affected versions are Qsync Central prior to 5.0.0.7, 5.1.0.3, 5.2.0.5, and 5.3.0.2. This medium-severity issue (CVSS 4.0 base 5.3) has no public exploit identified at time of analysis and requires the attacker to first obtain a valid account on the NAS.
Server-side request forgery in QNAP Download Station allows a low-privileged authenticated user to make the NAS application issue requests to internal or arbitrary destinations, resulting in limited disclosure of application data rather than any modification or denial of service. The flaw affects Download Station builds before 5.10.1.312 and the 5.11.x line before 5.11.2.321, and QNAP has published fixed versions for each branch. The issue is authentication-gated (CVSS 4.0 base 5.3, PR:L, confidentiality-only; independent assessment restricts impact to VC:L/VI:N/VA:N), and no public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis.
NULL pointer dereference in QNAP Qsync Central allows an authenticated remote user to cause a denial-of-service (DoS) condition that crashes the Qsync Central service. Exploitation requires the attacker to first obtain a valid Qsync Central / NAS user account, and the resulting crash is recoverable, affecting only the Qsync Central service rather than the entire NAS. No public exploit code has been identified at the time of analysis; the vendor has released a fix in Qsync Central 5.0.0.4 and later.
Authorization bypass in QNAP File Station 5 (versions 5.5.0 through 5.5.6.5243) allows a remote attacker with a valid low-privileged user account to circumvent intended access restrictions and reach files or operations they should not be able to access. The flaw was reported by QNAP itself with a CVSS 4.0 score of 8.6 reflecting high confidentiality and integrity impact, and there is no public exploit identified at time of analysis. Note that the vendor description text references 'File Station 6,' but the CPE, affected version list, and fix data all point to File Station 5, which appears to be a typo in the advisory.
Stack-based buffer overflow in QNAP File Station 5 versions 5.5.0 through 5.5.6.5208 allows authenticated remote attackers to corrupt memory and crash processes on affected NAS deployments. CVSS 4.0 score of 8.7 reflects high impact across confidentiality, integrity, and availability, though exploitation requires valid user credentials (PR:L). No public exploit identified at time of analysis, and the CVE is not currently listed in CISA KEV.
Unauthorized data access and action execution in QNAP QuMagie versions prior to 2.9.0 allows remote attackers to bypass authorization checks and interact with resources they should not be permitted to reach. The flaw is classified as a missing authorization issue (CWE-862) and carries a CVSS 4.0 score of 8.7 due to its network-reachable, low-complexity nature with no privileges or user interaction required. No public exploit identified at time of analysis, but QNAP NAS appliances are historically high-value targets for opportunistic attackers.
Authenticated command injection in QNAP QTS and QuTS hero NAS operating systems allows an attacker who already holds an administrator account to execute arbitrary OS commands on the appliance. The flaw carries a CVSS 4.0 score of 8.6, but the PR:H requirement substantially narrows the attacker population; no public exploit identified at time of analysis and the issue is not listed in CISA KEV. QNAP has shipped fixed builds (QTS 5.2.9.3492 build 20260507 and QuTS hero h5.2.9.3499 build 20260514).
Path traversal in QNAP QTS and QuTS hero NAS operating systems exposes arbitrary file contents to attackers who have already obtained administrator-level access. The root cause (CWE-22) indicates insufficient sanitization of file path inputs, allowing directory escape to reach files outside intended scope. No public exploit code has been identified at time of analysis, and CISA KEV lists no active exploitation - making this a targeted post-compromise risk rather than an opportunistic mass-exploitation scenario. Vendor-released patches address all affected branches as of May 2026.
NULL pointer dereference in QNAP QTS and QuTS hero NAS operating systems enables a remote, administrator-authenticated attacker to trigger a denial-of-service condition. Exploitation requires the attacker to first hold or acquire an administrator account on the target device, after which a crafted request can crash system services. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog at time of analysis.
Resource exhaustion in QNAP File Station 5 (versions 5.5.0 through 5.5.6.5242) allows a remote attacker holding a low-privilege user account to exhaust shared resources, denying availability to other users, processes, or applications on the same system. The vulnerability is classified as a Denial-of-Service risk with no impact on confidentiality or data integrity. No public exploit code or CISA KEV listing has been identified at time of analysis; QNAP has released a patched version and published a security advisory.
NULL pointer dereference in QNAP File Station 5 enables authenticated remote attackers to crash the service and cause a denial-of-service condition. Exploitation requires prior acquisition of a valid user account on the target QNAP NAS device, after which the attacker can trigger the dereference remotely over the network. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
NULL pointer dereference in QNAP QTS and QuTS hero NAS operating systems allows remote unauthenticated attackers to crash a network-facing service and cause a denial-of-service condition without any authentication or user interaction. Multiple active OS branches are affected - QTS 5.2.x and QuTS hero h5.2.x through h6.0.x - across a device population that is historically internet-exposed and frequently targeted. No public exploit has been identified and this vulnerability is not listed in CISA KEV, but the zero-authentication, network-accessible attack surface makes DoS attempts trivially repeatable against unpatched devices.
Integer overflow (CWE-190) in QNAP QTS and QuTS hero NAS operating systems allows a remote attacker who has already obtained an administrator account to further compromise system integrity and availability. Affected versions span QTS 5.2.x and QuTS hero h5.2.x through h6.0.x; QNAP released patched builds in February and May 2026. No public exploit code and no CISA KEV listing have been identified at time of analysis, and the mandatory prerequisite of administrator-level access materially constrains real-world exploitability.
Authenticated command injection in QNAP QTS and QuTS hero allows a remote attacker holding administrator credentials to execute arbitrary OS commands on the NAS appliance. The CVSS 4.0 base score of 8.6 reflects high impact across confidentiality, integrity, and availability, though exploitation requires high privileges (PR:H). No public exploit has been identified at time of analysis, and the issue is not listed in CISA KEV; QNAP has released fixed builds across affected QTS and QuTS hero branches.
Authenticated command injection in QNAP QTS and QuTS hero NAS operating systems allows a remote attacker who has already obtained administrator credentials to execute arbitrary OS commands on the appliance. Reported by QNAP itself and tracked as EUVD-2025-210099, the issue affects multiple branches across QTS 5.2.x and QuTS hero 5.2.x, 5.3.x, and 6.0.x and is fixed in builds dated 2026-02-06 through 2026-05-20. No public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Path traversal in QNAP License Center (versions 1.9.0 through 1.9.55) permits a high-privileged attacker with an administrator account to read arbitrary files or system data outside the intended directory scope. The CVSS 4.0 vector (AV:N/PR:H) indicates network-reachable exploitation contingent on first obtaining administrative credentials. No public exploit code or active exploitation has been identified at time of analysis; a vendor-released patch is available in version 1.9.56.
NULL pointer dereference in QNAP QuTS hero NAS operating system allows a remote attacker who has already obtained or possesses an administrator account to trigger a denial-of-service condition, crashing affected services. Affected branches span QuTS hero h5.2.x, h5.3.x, and h6.0.x series, with vendor-released patches available as of early-to-mid 2026. No public exploit code or CISA KEV listing has been identified at time of analysis, and the mandatory prerequisite of high-privilege authentication substantially constrains real-world impact.
Cross-site request forgery in QNAP Notification Center allows remote unauthenticated attackers to forge state-changing requests on behalf of authenticated NAS users, potentially resulting in privilege escalation or session hijacking within the Notification Center context. Affected versions are all Notification Center 1.10.0 builds prior to 1.10.0.3291, confirmed by QNAP advisory QSA-26-13 and EUVD-2025-210096. Exploitation requires active victim interaction (CVSS 4.0 UI:A), integrity impact is rated low (VI:L), and no public exploit code or active exploitation has been identified at time of analysis.
External control of assumed-immutable web parameters in QNAP NAS software enables remote unauthenticated attackers to achieve low-integrity impact by manipulating parameters the application treats as unmodifiable. The vulnerability requires active user interaction to trigger, limiting opportunistic exploitation. QNAP has released a fix per advisory QSA-26-10; no public exploit code or CISA KEV listing has been identified at time of analysis.
High-severity information disclosure flaw in QNAP QTS NAS operating system versions 5.2.0 through 5.2.7.3256 build 20250913 allows remote unauthenticated attackers to obtain sensitive data over the network with low attack complexity, per CVSS v4.0 vector AV:N/AC:L/PR:N/UI:N rating 9.2. The vendor has released a fix, and notably QuTS hero is explicitly unaffected. No public exploit identified at time of analysis, and the issue is not currently listed in CISA KEV.
Stack-based buffer overflow in QNAP QTS and QuTS hero NAS operating systems enables an authenticated administrator to corrupt stack memory or crash processes via a network-accessible attack path. Affected versions span QTS 5.2.x and multiple QuTS hero release trains (h5.2.x, h5.3.x, h6.0.x), with vendor-released patches dated February-May 2026. No public exploit code and no CISA KEV listing have been identified at time of analysis, and the mandatory high-privilege prerequisite substantially limits realistic attack surface.
Unauthorized data access and action execution in QNAP QuMagie versions prior to 2.9.0 allows remote attackers to bypass authorization checks over the network without authentication. The CVSS 4.0 score of 8.7 reflects high confidentiality impact with low attack complexity and no privileges required, though no public exploit identified at time of analysis and KEV listing is absent.
A stack-based buffer overflow vulnerability exists in QNAP Media Streaming Add-On that allows remote attackers to corrupt memory or crash the affected process. All versions prior to 500.1.1 are vulnerable, and the attack requires no authentication or user interaction. While no CVSS score or EPSS data is currently available, the presence of a confirmed patch and the critical nature of buffer overflow vulnerabilities in media processing software suggests this warrants immediate patching.
An improper restriction of communication channel to intended endpoints vulnerability (CWE-923) has been identified in QNAP QHora devices, allowing attackers with physical access to exploit insufficient endpoint validation and gain privileges intended for legitimate endpoints. The vulnerability affects QHora/QuRouter products prior to version 2.6.3.009. While no CVSS score or EPSS data is currently available and the vulnerability does not appear in active exploitation databases (KEV), the physical access requirement significantly constrains real-world exploitability, though the privilege escalation impact remains concerning for organizations with physical security controls.
A weak authentication vulnerability exists in QNAP QHora/QuRouter devices that allows attackers with local network access to bypass authentication mechanisms and disclose sensitive information. The vulnerability affects QuRouter versions prior to 2.6.2.007, and exploitation requires network-level access but no special privileges. While no CVSS score or EPSS data is publicly available, the classification as CWE-1390 (Weak Authentication) and the emphasis on local network access indicates this is a network-adjacent threat with moderate real-world risk, particularly in environments where untrusted devices can connect to the local network.
An improper neutralization of escape, meta, or control sequences vulnerability (CWE-150) affects QNAP QHora/QuRouter devices, allowing local attackers with administrator privileges to cause unexpected behavior through injection of unfiltered control sequences. The vulnerability has been patched in QuRouter version 2.6.3.009 and later. While no CVSS score, EPSS probability, or KEV/POC data are currently published, the requirement for local administrator access significantly limits exploitation scope in typical deployments.
An SQL injection vulnerability exists in QNAP QuRouter that allows authenticated local administrators to execute unauthorized code or commands through SQL injection techniques. The vulnerability affects QuRouter versions prior to 2.6.2.007, and exploitation requires an attacker to first obtain legitimate administrator credentials on the affected device. While no CVSS score or EPSS data is currently published, the SQL injection classification (CWE-89) combined with code execution impact represents a critical risk for compromised administrator accounts.
A cross-site scripting (XSS) vulnerability exists in QuFTP Service that allows authenticated remote attackers with administrator credentials to bypass security mechanisms and read application data. The vulnerability affects multiple versions of QuFTP Service across different release branches (1.4.x, 1.5.x, and 1.6.x prior to specified patch versions). While no CVSS score, EPSS probability, or KEV status is currently available, the requirement for administrator-level access significantly constrains real-world exploitation risk.
QuNetSwitch contains hard-coded credentials that allow remote attackers to bypass authentication and gain unauthorized access to affected systems. This vulnerability affects QuNetSwitch versions prior to 2.0.5.0906, where credentials are embedded in the application code rather than properly managed through secure credential storage mechanisms. Remote attackers can exploit this weakness without requiring valid user credentials, leading to complete compromise of the network switch management interface.
Command injection in QuNetSwitch allows authenticated remote attackers to execute arbitrary commands on affected systems with high impact to confidentiality and integrity. The vulnerability requires valid user credentials to exploit but poses significant risk to systems running versions prior to 2.0.5.0906. No patch is currently available for this CVSS 6.3 medium-severity issue.
Arbitrary command execution in QuNetSwitch can be achieved by local attackers with administrator privileges due to insufficient input validation in command processing. This vulnerability affects QuNetSwitch versions prior to 2.0.5.0906, allowing authenticated high-privilege users to bypass security controls and execute system commands. No patch is currently available for affected versions.