Qnap
Monthly
Unauthenticated remote command execution in QNAP HybridDesk Station (HD Station) lets network attackers run arbitrary operating system commands on affected QNAP NAS devices that have the optional desktop/multimedia add-on installed. The root cause is an OS command injection (CWE-78) rated 9.3 under CVSS v4.0 (AV:N/AC:L/PR:N/UI:N), so no credentials, user interaction, or special preconditions are required; the vendor has fixed it in HybridDesk Station 4.2.23 (4.2 branch) and 4.3.4 (4.3 branch). No public exploit code or confirmed active exploitation has been identified at time of analysis, but real-world risk is governed by whether HD Station is installed and whether its interface is reachable from the attacker's network position (LAN versus internet-facing), as the specific vulnerable feature and input parameter have not been disclosed.
QNAP HybridDesk Station (HD Station) before 4.2.22 contains a missing authentication flaw in a critical function, allowing unauthenticated attackers on an adjacent network to gain access to the system. Exploitation is constrained by a specific attack precondition and passive user interaction, and only QNAP NAS devices with the optional HD Station app installed and enabled are exposed. The vendor has released HybridDesk Station 4.2.22 and later as a fix; no public exploit was identified at time of analysis.
Incorrect permission assignment (CWE-732) in QNAP Notes Station 3 allows a local attacker who already holds a valid low-privileged account on the NAS to abuse an insecurely permissioned critical resource created by the application, resulting in full compromise of confidentiality, integrity, and availability of the affected system's data. Only QNAP NAS devices with the Notes Station 3 app installed are affected, and exploitation is not possible remotely by an unauthenticated attacker - it requires local access plus a user account (AV:L, PR:L per CVSS:4.0 vector and the assessed CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). No public exploit code has been identified at time of analysis, and EPSS/KEV data were not provided; QNAP has released a fix in Notes Station 3 3.9.11 and later.
Authenticated remote attackers holding a valid QuMagie account can exploit a Unix symbolic-link following flaw (CWE-61) in QNAP's QuMagie photo and media management application to compromise the security of the underlying NAS system. The vulnerable code follows attacker-influenced symlinks during file operations, allowing file reads and writes outside the intended media library boundaries, with the assessed vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) reflecting high confidentiality, integrity and availability impact that crosses a security scope boundary - essentially escaping the application sandbox to reach the host NAS. Exploitation requires the attacker to first obtain a QuMagie user account (PR:L) and the ability to place a symlink or control a path the app will follow; no victim interaction is needed. There is no public exploit identified at time of analysis, and QNAP has released a fix in QuMagie 2.9.2 and later.
Unauthenticated remote attackers can read sensitive data from QNAP NAS devices running the optional Video Station (VideoStationPro) application prior to 5.8.8 by exploiting a CWE-639 authorization bypass through a user-controlled key. The vendor rates the flaw 8.7 under CVSS 4.0 (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N) and our independent assessment scores it 7.5 under CVSS 3.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), reflecting a confidentiality-only impact with no integrity or availability loss. Exploitation requires Video Station to be installed and network-reachable on a QTS/QuTS NAS, and no public exploit code or CISA KEV listing was identified at time of analysis, so this is a high-priority information-disclosure issue rather than a confirmed actively exploited one.
Authenticated path traversal in QNAP QuMagie lets an attacker who already holds a QuMagie administrator account read files and system data outside the intended media library on the underlying QNAP NAS. The flaw is remote, network-reachable and low-complexity, but the PR:H privilege requirement in the CVSS vector means it is not exploitable by anonymous users against default installations; no public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV. QNAP has shipped a fix in QuMagie 2.9.1 and later, so exposure is limited to NAS deployments still running older QuMagie builds and reachable by an admin-level account.
Incorrect permission assignment in QNAP Download Station (all builds prior to 5.10.1.312 or 5.11.2.321) lets a local attacker who already holds an administrator account on the NAS escalate that foothold into full compromise of the device's confidentiality, integrity and availability. The issue is access-gated rather than remotely reachable: the CVSS:4.0 vector marks local attack vector (AV:L) and high privileges (PR:H), so a remote or unauthenticated attacker cannot trigger it and no user interaction is required once admin access exists. No public exploit code has been identified at time of analysis and the flaw is not confirmed as actively exploited (CISA KEV), but vendor-released fixes are available, so the practical risk sits with deployments that share, weakly protect, or already have compromised QNAP admin credentials.
SQL injection in QNAP Video Station before version 5.8.8 lets a remote attacker who already holds a valid Video Station user account inject arbitrary SQL into the application's database queries, exposing stored data with high confidentiality impact and a limited availability effect. The vendor-reported vector (CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L, 7.1) and our independent assessment (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L) agree that the vulnerability is network-reachable, low complexity and requires no user interaction, but that the attacker must first authenticate as a Video Station user - this authentication prerequisite is the main limiting factor and rules out fully unauthenticated internet exploitation. There is no public exploit identified at time of analysis, and QNAP has already shipped a fix in Video Station 5.8.8 and later, so risk is highest for NAS devices that expose Video Station to untrusted networks and provision multiple or guest-level accounts.
SQL injection in QNAP Video Station (versions prior to 5.8.8) allows a remote attacker who already holds a valid NAS user account to read sensitive data from the application's backend database through the Video Station web interface. The flaw is an authenticated issue (CVSS PR:L), and the independent assessment bounds the impact to confidentiality only (C:H), meaning it does not by itself provide code execution or service disruption despite the description's broader wording. No public exploit code was identified at time of analysis, and the vendor has released a fix in Video Station 5.8.8 and later.
Path traversal in QNAP's QcalAgent (Qcalendar) app for NAS devices lets a remote attacker who already holds a low-privileged user account read files and system data outside the intended directory. Only installations running QcalAgent 1.1.x below 1.1.10 are exposed, since the flaw is fixed in 1.1.10 and later, and the authentication prerequisite (PR:L in both the vendor CVSS 4.0 vector and our assessed CVSS 3.1 vector) means unauthenticated outsiders cannot reach it. No KEV listing and no public exploit code exists at time of analysis, but the vendor scores it 8.7 under CVSS 4.0, so patching should be prioritized wherever the optional app is installed and user accounts are shared broadly.
Authenticated path traversal in QNAP Download Station allows a remote user with a valid account to read arbitrary files outside the intended directory, potentially exposing system data. Affected versions are Download Station 5.10.x before 5.10.2.313 and 5.11.x before 5.11.3.322; the vendor has released fixes. No public exploit code or active exploitation has been identified at time of analysis, and the risk is conditional on valid credentials and network reachability to the NAS.
Stack memory corruption in the Linux kernel's qnap-mcu MFD driver allows a local low-privileged user on QNAP hardware to corrupt kernel stack memory, potentially enabling privilege escalation. The driver's qnap_mcu_exec() publishes an on-stack receive buffer to the serdev receive path, which runs asynchronously; when a command times out and the function returns, reply->data still points at the deallocated stack frame. A late MCU reply or unsolicited MCU message then overwrites whatever occupies that stack memory next, yielding C:H/I:H/A:H impact. No public exploit exists and EPSS is 0.20% (10th percentile), consistent with a kernel driver bug requiring physical or local QNAP hardware access.
Authenticated command injection in QNAP QTS and QuTS hero NAS operating systems allows attackers with administrator credentials to execute arbitrary OS commands on the appliance. The flaw spans multiple QTS and QuTS hero release trains (5.2.x, 5.3.x, and 6.0.x) and has been patched by QNAP across all affected branches. No public exploit identified at time of analysis, and the vulnerability is not currently listed in CISA KEV, but the post-authentication code execution primitive is highly valuable for attackers who have already harvested admin credentials.
An OS command injection vulnerability has been found to affect legacy QNAP VioStor NVR models running QVR Firmware 4.x. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
An externally controlled reference to a resource vulnerability has been reported to affect QNAP NAS running Photo Station. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An improper authorization vulnerability has been reported to affect QNAP NAS running HBS 3 (Hybrid Backup Sync. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
This external control of file name or path vulnerability allows remote attackers to access or modify system files. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
This external control of file name or path vulnerability allows remote attackers to access or modify system files. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
This improper input validation vulnerability allows remote attackers to inject arbitrary code to the system. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
This improper access control vulnerability allows remote attackers to gain unauthorized access to the system. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Command injection vulnerability in change password of QNAP Q'center Virtual Appliance version 1.7.1063 and earlier could allow authenticated users to run arbitrary commands. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Exposure of Private Information in QNAP Q'center Virtual Appliance version 1.7.1063 and earlier could allow authenticated users to access sensitive information. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
QNAP has patched a remote code execution vulnerability affecting the QTS Media Library in all versions prior to QTS 4.2.6 build 20170905 and QTS 4.3.3.0299 build 20170901. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 51.1%.
GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of environment variables, which allows remote attackers to write to files or. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which allows remote attackers to execute arbitrary code via a crafted environment,. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
Authenticated cross-site scripting in QNAP's QuFTP Service allows a remote attacker who already holds a valid QuFTP user account to inject malicious script that executes in a victim's browser within the NAS web interface, potentially compromising the wider session context rather than the FTP service alone. The flaw affects QuFTP Service installations on QNAP NAS devices in branches prior to 1.4.6, 1.5.5, and 1.6.5, and successful exploitation additionally requires a victim to view the injected content. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the mandatory account prerequisite plus the user-interaction requirement are the principal limiters on real-world risk.
QNAP Notes Station 3 versions prior to 3.9.11 contain an OS command injection flaw (CWE-78) that permits unauthenticated network attackers to run arbitrary commands on a NAS where the optional Notes Station 3 add-on is installed and reachable. The vendor's CVSS 4.0 vector (6.9) indicates low confidentiality, integrity, and availability impact, suggesting the injected commands execute in a constrained context rather than granting full system control. No public exploit code has been identified at time of analysis, and the primary exposure is limited to internet-facing or broadly accessible NAS instances running the vulnerable add-on.
Authenticated remote attackers with a valid Qsync Central user account can exploit a unix symbolic link (symlink) following vulnerability (CWE-61) in QNAP Qsync Central to compromise system security, potentially leading to low impact on confidentiality, integrity, and availability. Affected versions are Qsync Central prior to 5.0.0.7, 5.1.0.3, 5.2.0.5, and 5.3.0.2. This medium-severity issue (CVSS 4.0 base 5.3) has no public exploit identified at time of analysis and requires the attacker to first obtain a valid account on the NAS.
Server-side request forgery in QNAP Download Station allows a low-privileged authenticated user to make the NAS application issue requests to internal or arbitrary destinations, resulting in limited disclosure of application data rather than any modification or denial of service. The flaw affects Download Station builds before 5.10.1.312 and the 5.11.x line before 5.11.2.321, and QNAP has published fixed versions for each branch. The issue is authentication-gated (CVSS 4.0 base 5.3, PR:L, confidentiality-only; independent assessment restricts impact to VC:L/VI:N/VA:N), and no public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis.
Denial of service in QNAP File Station 5 (versions prior to 5.5.6.5243) allows any authenticated user to trigger a NULL pointer dereference via a network request, causing availability impact only. Exploitation requires a valid File Station 5 account, is network-reachable with low complexity and no user interaction, and no public exploit has been identified at time of analysis. The vendor has released a patch in version 5.5.6.5243 and later.
Denial of service in QNAP File Station 5 affects installations running versions before 5.5.6.5243; an authenticated remote attacker with a valid NAS user account can send a crafted request that dereferences a NULL pointer and disrupts the File Station service. The issue is limited to availability (C:N/I:N/A:L), requires low privileges but no user interaction, and all available signals indicate low real-world priority; no public exploit code or confirmed active exploitation was identified at time of analysis, and QNAP has released File Station 5 5.5.6.5243 as the fixed version.
Authenticated denial of service in QNAP File Station 5 allows a remote attacker who already holds a valid low-privileged QNAP NAS user account to crash the File Station application by sending a crafted request that triggers a NULL pointer dereference (CWE-476); impact is confined to availability of that application, with no confidentiality or integrity loss. The affected code is the network-facing File Station service on NAS devices running versions before 5.5.6.5243, and the authentication prerequisite (PR:L in both the CNA and independently assessed vectors) confines realistic exploitation to malicious insiders or to attackers who have separately compromised a user login. No public exploit or proof-of-concept has been identified at time of analysis, the issue is not listed in CISA KEV, and no EPSS score was provided; the independent assessment confirms this is a genuinely low-priority issue despite being network-reachable.
Path traversal in QNAP Qsync Central allows an authenticated remote attacker to read the contents of unexpected files or system data. Exploitation requires a valid Qsync Central user account and results in low confidentiality impact with no integrity or availability loss. No public exploit identified at time of analysis, and the vendor has released patches in versions 5.0.0.7, 5.1.0.3, 5.2.0.5, and 5.3.0.2 and later.
A timing side-channel in QNAP QuRouter allows attackers on an adjacent network segment to extract limited sensitive data by measuring response-time discrepancies, without authentication and without user interaction. The issue is fixed in QuRouter 2.7.2.113 and later; the vendor advisory confirms a patched release is available. No public exploit code or active exploitation has been identified at time of analysis, and the scored risk is low (CVSS 4.0 base 1.3; independently assessed as CVSS 3.1 AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N), with the relevant confidentiality impact only and no integrity or availability effect.
Stored cross-site scripting in QNAP's Network & Virtual Switch component, shipped with QTS, QuTS hero, and QuTS cloud, lets an attacker who already holds a QNAP administrator account inject malicious script into the management interface, which then executes in the browser of another administrator who loads the affected page. Exploitation therefore requires two preconditions that are both confirmed by the CVSS vector (PR:H and UI:P): valid administrative credentials and victim interaction, which confines realistic impact to multi-administrator deployments where attackers can reach an already-authenticated peer. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the CVSS 4.0 base score is only 2.2, so this is a low-priority, post-compromise hardening issue rather than an externally exploitable entry point.
QuRouter 2.6.x devices below 2.6.4.001 contain a time-of-check time-of-use race condition that can allow an unauthenticated attacker on the same adjacent network segment to compromise confidentiality, integrity, and availability, but only if they win a timing-dependent race while a legitimate user operation is in progress. The vendor has released QuRouter 2.6.4.001 and later to fix the issue, and no public exploit was identified at time of analysis; the CVSS 4.0 base score is 7.5, though the adjacent-network, race-window, and user-interaction prerequisites substantially limit realistic exploitation.
Modification of protected system or configuration data in QNAP QuRouter is possible when a local attacker who already holds a QuRouter administrator account abuses an external-control-of-configuration flaw (CWE-15). This is an authenticated, local-only issue with low integrity impact and no confidentiality or availability impact; there is no remote or unauthenticated path. QNAP fixed it in QuRouter 2.7.2.113 and later, and no public exploit code has been identified at time of analysis.
Path traversal (CWE-22) in QNAP Video Station 5.8.x before 5.8.5 lets an authenticated remote user escape the application's intended media directory and read unexpected files or system data on the underlying NAS. The attacker must first hold a valid account on the target QNAP device (CVSS 3.1 PR:L), so exposure is limited to holders of legitimate low-privilege credentials or anyone able to register or compromise such an account; the vendor's CVSS 4.0 vector additionally carries the AT:P flag, indicating an attack requirement outside the attacker's direct control. There is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis, and QNAP has already released a fixed version, so this is a moderate-priority issue that nevertheless warrants prompt patching on internet-exposed NAS devices with open registration or weak accounts.
Authenticated path traversal in QNAP Video Station 5.8.x (fixed in 5.8.5) allows a low-privilege NAS user to read files and system data outside the intended application directory. The flaw requires a valid Video Station login (CVSS PR:L) plus the vendor's stated attack precondition (AT:P), and its impact is limited to information disclosure rather than code execution. No public exploit has been identified at time of analysis, and the practical risk is moderate: a real but constrained, authenticated file-read issue rather than a critical remotely weaponizable bug.
Authenticated buffer overflow in QNAP Qsync Central (the QsyncServer app on QNAP NAS devices) prior to 5.0.0.4 allows a remote attacker who already holds a valid Qsync Central user account to corrupt memory or crash the Qsync process, degrading availability with no confirmed path to data theft or modification. The vulnerability is a classic CWE-120 buffer copy without input-size checking, and the assessed CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/C:N/I:N/A:L) confirms the impact is availability-only and gated behind account possession. There is no public exploit identified at time of analysis, no evidence of active exploitation, and an official fix is available in Qsync Central 5.0.0.4 and later, making this a low-priority, readily remediated issue.
Denial of service in QNAP Qsync Central before 5.0.0.4 can be triggered by an authenticated low-privileged user who reaches a NULL pointer dereference in the service. The vendor has fixed the issue in Qsync Central 5.0.0.4 and later, no public exploit identified at time of analysis, and the independent assessment rates this as a genuinely low-priority, availability-only issue.
Stack-based buffer overflow in QNAP File Station 5 enables remote unauthenticated attackers to corrupt memory or destabilize processes through a network-accessible attack path requiring only passive user interaction. Affected versions are all releases prior to 5.5.6.5243; QNAP's own security team (security@qnapsecurity.com.tw) discovered and disclosed the issue via advisory QSA-26-27. No public exploit code exists and the vulnerability is not listed in CISA KEV; however, the unauthenticated network attack vector lowers the bar for opportunistic targeting of QNAP NAS deployments.
Stack-based buffer overflow in QNAP File Station 5 allows unauthenticated remote attackers to corrupt process memory or crash the file management service when a victim user passively interacts with a crafted input. Affected versions are all File Station 5 releases prior to 5.5.6.5243, running on QNAP NAS devices accessible over the network. No public exploit code has been identified and this CVE is not listed in the CISA KEV catalog; QNAP has confirmed and released a fix in version 5.5.6.5243 via advisory QSA-26-32.
Authenticated command injection in QNAP QTS and QuTS hero NAS operating systems allows an attacker who already holds an administrator account to execute arbitrary OS commands on the appliance. The flaw carries a CVSS 4.0 score of 8.6, but the PR:H requirement substantially narrows the attacker population; no public exploit identified at time of analysis and the issue is not listed in CISA KEV. QNAP has shipped fixed builds (QTS 5.2.9.3492 build 20260507 and QuTS hero h5.2.9.3499 build 20260514).
Path traversal in QNAP QTS and QuTS hero NAS operating systems exposes arbitrary file contents to attackers who have already obtained administrator-level access. The root cause (CWE-22) indicates insufficient sanitization of file path inputs, allowing directory escape to reach files outside intended scope. No public exploit code has been identified at time of analysis, and CISA KEV lists no active exploitation - making this a targeted post-compromise risk rather than an opportunistic mass-exploitation scenario. Vendor-released patches address all affected branches as of May 2026.
NULL pointer dereference in QNAP QTS and QuTS hero NAS operating systems enables a remote, administrator-authenticated attacker to trigger a denial-of-service condition. Exploitation requires the attacker to first hold or acquire an administrator account on the target device, after which a crafted request can crash system services. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog at time of analysis.
NULL pointer dereference in QNAP QTS and QuTS hero NAS operating systems allows remote unauthenticated attackers to crash a network-facing service and cause a denial-of-service condition without any authentication or user interaction. Multiple active OS branches are affected - QTS 5.2.x and QuTS hero h5.2.x through h6.0.x - across a device population that is historically internet-exposed and frequently targeted. No public exploit has been identified and this vulnerability is not listed in CISA KEV, but the zero-authentication, network-accessible attack surface makes DoS attempts trivially repeatable against unpatched devices.
Integer overflow (CWE-190) in QNAP QTS and QuTS hero NAS operating systems allows a remote attacker who has already obtained an administrator account to further compromise system integrity and availability. Affected versions span QTS 5.2.x and QuTS hero h5.2.x through h6.0.x; QNAP released patched builds in February and May 2026. No public exploit code and no CISA KEV listing have been identified at time of analysis, and the mandatory prerequisite of administrator-level access materially constrains real-world exploitability.
Authenticated command injection in QNAP QTS and QuTS hero allows a remote attacker holding administrator credentials to execute arbitrary OS commands on the NAS appliance. The CVSS 4.0 base score of 8.6 reflects high impact across confidentiality, integrity, and availability, though exploitation requires high privileges (PR:H). No public exploit has been identified at time of analysis, and the issue is not listed in CISA KEV; QNAP has released fixed builds across affected QTS and QuTS hero branches.
Authenticated command injection in QNAP QTS and QuTS hero NAS operating systems allows a remote attacker who has already obtained administrator credentials to execute arbitrary OS commands on the appliance. Reported by QNAP itself and tracked as EUVD-2025-210099, the issue affects multiple branches across QTS 5.2.x and QuTS hero 5.2.x, 5.3.x, and 6.0.x and is fixed in builds dated 2026-02-06 through 2026-05-20. No public exploit identified at time of analysis and the issue is not listed in CISA KEV.
NULL pointer dereference in QNAP QuTS hero NAS operating system allows a remote attacker who has already obtained or possesses an administrator account to trigger a denial-of-service condition, crashing affected services. Affected branches span QuTS hero h5.2.x, h5.3.x, and h6.0.x series, with vendor-released patches available as of early-to-mid 2026. No public exploit code or CISA KEV listing has been identified at time of analysis, and the mandatory prerequisite of high-privilege authentication substantially constrains real-world impact.
Stack-based buffer overflow in QNAP QTS and QuTS hero NAS operating systems enables an authenticated administrator to corrupt stack memory or crash processes via a network-accessible attack path. Affected versions span QTS 5.2.x and multiple QuTS hero release trains (h5.2.x, h5.3.x, h6.0.x), with vendor-released patches dated February-May 2026. No public exploit code and no CISA KEV listing have been identified at time of analysis, and the mandatory high-privilege prerequisite substantially limits realistic attack surface.
Cross-site scripting in QNAP QTS and QuTS hero operating systems allows remote attackers to bypass security mechanisms and read application data when an authenticated user interacts with attacker-supplied content. The flaw carries a CVSS 4.0 score of 8.7 driven by network reachability, low attack complexity, no required privileges, and high impact across confidentiality, integrity, and availability of the NAS management surface. There is no public exploit identified at time of analysis and the vulnerability is not listed in CISA KEV.
QNAP Hyper Data Protector before 2.3.1.455 contains hard-coded credentials that allow remote unauthenticated attackers to gain unauthorized access to backup management functions, potentially compromising all backed-up data across the organization.
A command injection vulnerability has been reported to affect several QNAP operating system versions. If an attacker gains local network access who have also gained a user account, they can then exploit the vulnerability to execute arbitrary commands. [CVSS 7.8 HIGH]
An SQL injection vulnerability has been reported to affect Video Station. If an attacker gains local network access who have also gained an administrator account, they can then exploit the vulnerability to execute unauthorized code or commands.
An improper certificate validation vulnerability has been reported to affect Video Station. If an attacker gains local network access who have also gained an administrator account, they can then exploit the vulnerability to compromise the security of the system.
File Station 6 contains a path traversal vulnerability that allows authenticated attackers to read arbitrary files and system data on affected systems. An attacker with valid user credentials can exploit this flaw to access sensitive information beyond intended restrictions. No patch is currently available for File Station 6, though File Station 5.5.6.5190 and later versions have been remediated.
A path traversal vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data. [CVSS 6.5 MEDIUM]
A path traversal vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data. [CVSS 6.5 MEDIUM]
Symlink following vulnerability in multiple QNAP NAS operating system versions allows remote attackers to exploit link resolution for unauthorized access.
A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack. [CVSS 4.9 MEDIUM]
A path traversal vulnerability has been reported to affect File Station 5. If a local attacker gains an administrator account, they can then exploit the vulnerability to read the contents of unexpected files or system data. [CVSS 4.4 MEDIUM]
A path traversal vulnerability has been reported to affect File Station 5. If a local attacker gains an administrator account, they can then exploit the vulnerability to read the contents of unexpected files or system data. [CVSS 4.4 MEDIUM]
An uncontrolled resource consumption vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack. [CVSS 6.5 MEDIUM]
A path traversal vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data. [CVSS 6.5 MEDIUM]
A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack. [CVSS 4.9 MEDIUM]
A NULL pointer dereference vulnerability has been reported to affect Qsync Central. If a remote attacker gains an administrator account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack. [CVSS 4.9 MEDIUM]
An allocation of resources without limits or throttling vulnerability has been reported to affect Qsync Central. If a remote attacker gains an administrator account, they can then exploit the vulnerability to prevent other systems, applications, or processes from accessing the same type of resource. [CVSS 4.9 MEDIUM]
A path traversal vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data. [CVSS 6.5 MEDIUM]
A relative path traversal vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data. [CVSS 6.5 MEDIUM]
A use of uninitialized variable vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to denial of service conditions, or modify control flow in unexpected ways. [CVSS 4.9 MEDIUM]
A weak authentication vulnerability has been reported to affect File Station 5. The remote attackers can then exploit the vulnerability to gain sensitive information. [CVSS 7.5 HIGH]
An allocation of resources without limits or throttling vulnerability has been reported to affect Qsync Central. If a remote attacker gains an administrator account, they can then exploit the vulnerability to prevent other systems, applications, or processes from accessing the same type of resource. [CVSS 4.9 MEDIUM]
An allocation of resources without limits or throttling vulnerability has been reported to affect Qsync Central. If a remote attacker gains an administrator account, they can then exploit the vulnerability to prevent other systems, applications, or processes from accessing the same type of resource. [CVSS 4.9 MEDIUM]
A buffer overflow vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to modify memory or crash processes. [CVSS 8.1 HIGH]
An allocation of resources without limits or throttling vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to prevent other systems, applications, or processes from accessing the same type of resource. [CVSS 6.5 MEDIUM]
An improper neutralization of directives in statically saved code ('Static Code Injection') vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit the vulnerability to access restricted data / files. [CVSS 8.8 HIGH]
An out-of-bounds read vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to obtain secret data. [CVSS 6.5 MEDIUM]
An out-of-bounds read vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit the vulnerability to obtain secret data. [CVSS 6.5 MEDIUM]
A NULL pointer dereference vulnerability has been reported to affect File Station 5. If a remote attacker gains an administrator account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack. [CVSS 4.9 MEDIUM]
A path traversal vulnerability has been reported to affect File Station 5. If a remote attacker gains an administrator account, they can then exploit the vulnerability to read the contents of unexpected files or system data. [CVSS 4.9 MEDIUM]
An allocation of resources without limits or throttling vulnerability has been reported to affect File Station 5. [CVSS 4.9 MEDIUM]
An allocation of resources without limits or throttling vulnerability has been reported to affect File Station 5. [CVSS 4.9 MEDIUM]
A use of out-of-range pointer offset vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to read sensitive portions of memory. [CVSS 6.5 MEDIUM]
An uncontrolled resource consumption vulnerability has been reported to affect Qsync Central. If a local attacker gains a user account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack. [CVSS 5.5 MEDIUM]
An uncontrolled resource consumption vulnerability has been reported to affect Qsync Central. If a local attacker gains a user account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack. [CVSS 5.5 MEDIUM]
An uncontrolled resource consumption vulnerability has been reported to affect Qsync Central. If a local attacker gains a user account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack. [CVSS 5.5 MEDIUM]
A NULL pointer dereference vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack. [CVSS 6.5 MEDIUM]
A NULL pointer dereference vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack. [CVSS 6.5 MEDIUM]
Unauthenticated remote command execution in QNAP HybridDesk Station (HD Station) lets network attackers run arbitrary operating system commands on affected QNAP NAS devices that have the optional desktop/multimedia add-on installed. The root cause is an OS command injection (CWE-78) rated 9.3 under CVSS v4.0 (AV:N/AC:L/PR:N/UI:N), so no credentials, user interaction, or special preconditions are required; the vendor has fixed it in HybridDesk Station 4.2.23 (4.2 branch) and 4.3.4 (4.3 branch). No public exploit code or confirmed active exploitation has been identified at time of analysis, but real-world risk is governed by whether HD Station is installed and whether its interface is reachable from the attacker's network position (LAN versus internet-facing), as the specific vulnerable feature and input parameter have not been disclosed.
QNAP HybridDesk Station (HD Station) before 4.2.22 contains a missing authentication flaw in a critical function, allowing unauthenticated attackers on an adjacent network to gain access to the system. Exploitation is constrained by a specific attack precondition and passive user interaction, and only QNAP NAS devices with the optional HD Station app installed and enabled are exposed. The vendor has released HybridDesk Station 4.2.22 and later as a fix; no public exploit was identified at time of analysis.
Incorrect permission assignment (CWE-732) in QNAP Notes Station 3 allows a local attacker who already holds a valid low-privileged account on the NAS to abuse an insecurely permissioned critical resource created by the application, resulting in full compromise of confidentiality, integrity, and availability of the affected system's data. Only QNAP NAS devices with the Notes Station 3 app installed are affected, and exploitation is not possible remotely by an unauthenticated attacker - it requires local access plus a user account (AV:L, PR:L per CVSS:4.0 vector and the assessed CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). No public exploit code has been identified at time of analysis, and EPSS/KEV data were not provided; QNAP has released a fix in Notes Station 3 3.9.11 and later.
Authenticated remote attackers holding a valid QuMagie account can exploit a Unix symbolic-link following flaw (CWE-61) in QNAP's QuMagie photo and media management application to compromise the security of the underlying NAS system. The vulnerable code follows attacker-influenced symlinks during file operations, allowing file reads and writes outside the intended media library boundaries, with the assessed vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) reflecting high confidentiality, integrity and availability impact that crosses a security scope boundary - essentially escaping the application sandbox to reach the host NAS. Exploitation requires the attacker to first obtain a QuMagie user account (PR:L) and the ability to place a symlink or control a path the app will follow; no victim interaction is needed. There is no public exploit identified at time of analysis, and QNAP has released a fix in QuMagie 2.9.2 and later.
Unauthenticated remote attackers can read sensitive data from QNAP NAS devices running the optional Video Station (VideoStationPro) application prior to 5.8.8 by exploiting a CWE-639 authorization bypass through a user-controlled key. The vendor rates the flaw 8.7 under CVSS 4.0 (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N) and our independent assessment scores it 7.5 under CVSS 3.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), reflecting a confidentiality-only impact with no integrity or availability loss. Exploitation requires Video Station to be installed and network-reachable on a QTS/QuTS NAS, and no public exploit code or CISA KEV listing was identified at time of analysis, so this is a high-priority information-disclosure issue rather than a confirmed actively exploited one.
Authenticated path traversal in QNAP QuMagie lets an attacker who already holds a QuMagie administrator account read files and system data outside the intended media library on the underlying QNAP NAS. The flaw is remote, network-reachable and low-complexity, but the PR:H privilege requirement in the CVSS vector means it is not exploitable by anonymous users against default installations; no public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV. QNAP has shipped a fix in QuMagie 2.9.1 and later, so exposure is limited to NAS deployments still running older QuMagie builds and reachable by an admin-level account.
Incorrect permission assignment in QNAP Download Station (all builds prior to 5.10.1.312 or 5.11.2.321) lets a local attacker who already holds an administrator account on the NAS escalate that foothold into full compromise of the device's confidentiality, integrity and availability. The issue is access-gated rather than remotely reachable: the CVSS:4.0 vector marks local attack vector (AV:L) and high privileges (PR:H), so a remote or unauthenticated attacker cannot trigger it and no user interaction is required once admin access exists. No public exploit code has been identified at time of analysis and the flaw is not confirmed as actively exploited (CISA KEV), but vendor-released fixes are available, so the practical risk sits with deployments that share, weakly protect, or already have compromised QNAP admin credentials.
SQL injection in QNAP Video Station before version 5.8.8 lets a remote attacker who already holds a valid Video Station user account inject arbitrary SQL into the application's database queries, exposing stored data with high confidentiality impact and a limited availability effect. The vendor-reported vector (CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L, 7.1) and our independent assessment (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L) agree that the vulnerability is network-reachable, low complexity and requires no user interaction, but that the attacker must first authenticate as a Video Station user - this authentication prerequisite is the main limiting factor and rules out fully unauthenticated internet exploitation. There is no public exploit identified at time of analysis, and QNAP has already shipped a fix in Video Station 5.8.8 and later, so risk is highest for NAS devices that expose Video Station to untrusted networks and provision multiple or guest-level accounts.
SQL injection in QNAP Video Station (versions prior to 5.8.8) allows a remote attacker who already holds a valid NAS user account to read sensitive data from the application's backend database through the Video Station web interface. The flaw is an authenticated issue (CVSS PR:L), and the independent assessment bounds the impact to confidentiality only (C:H), meaning it does not by itself provide code execution or service disruption despite the description's broader wording. No public exploit code was identified at time of analysis, and the vendor has released a fix in Video Station 5.8.8 and later.
Path traversal in QNAP's QcalAgent (Qcalendar) app for NAS devices lets a remote attacker who already holds a low-privileged user account read files and system data outside the intended directory. Only installations running QcalAgent 1.1.x below 1.1.10 are exposed, since the flaw is fixed in 1.1.10 and later, and the authentication prerequisite (PR:L in both the vendor CVSS 4.0 vector and our assessed CVSS 3.1 vector) means unauthenticated outsiders cannot reach it. No KEV listing and no public exploit code exists at time of analysis, but the vendor scores it 8.7 under CVSS 4.0, so patching should be prioritized wherever the optional app is installed and user accounts are shared broadly.
Authenticated path traversal in QNAP Download Station allows a remote user with a valid account to read arbitrary files outside the intended directory, potentially exposing system data. Affected versions are Download Station 5.10.x before 5.10.2.313 and 5.11.x before 5.11.3.322; the vendor has released fixes. No public exploit code or active exploitation has been identified at time of analysis, and the risk is conditional on valid credentials and network reachability to the NAS.
Stack memory corruption in the Linux kernel's qnap-mcu MFD driver allows a local low-privileged user on QNAP hardware to corrupt kernel stack memory, potentially enabling privilege escalation. The driver's qnap_mcu_exec() publishes an on-stack receive buffer to the serdev receive path, which runs asynchronously; when a command times out and the function returns, reply->data still points at the deallocated stack frame. A late MCU reply or unsolicited MCU message then overwrites whatever occupies that stack memory next, yielding C:H/I:H/A:H impact. No public exploit exists and EPSS is 0.20% (10th percentile), consistent with a kernel driver bug requiring physical or local QNAP hardware access.
Authenticated command injection in QNAP QTS and QuTS hero NAS operating systems allows attackers with administrator credentials to execute arbitrary OS commands on the appliance. The flaw spans multiple QTS and QuTS hero release trains (5.2.x, 5.3.x, and 6.0.x) and has been patched by QNAP across all affected branches. No public exploit identified at time of analysis, and the vulnerability is not currently listed in CISA KEV, but the post-authentication code execution primitive is highly valuable for attackers who have already harvested admin credentials.
An OS command injection vulnerability has been found to affect legacy QNAP VioStor NVR models running QVR Firmware 4.x. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
An externally controlled reference to a resource vulnerability has been reported to affect QNAP NAS running Photo Station. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An improper authorization vulnerability has been reported to affect QNAP NAS running HBS 3 (Hybrid Backup Sync. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
This external control of file name or path vulnerability allows remote attackers to access or modify system files. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
This external control of file name or path vulnerability allows remote attackers to access or modify system files. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
This improper input validation vulnerability allows remote attackers to inject arbitrary code to the system. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
This improper access control vulnerability allows remote attackers to gain unauthorized access to the system. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Command injection vulnerability in change password of QNAP Q'center Virtual Appliance version 1.7.1063 and earlier could allow authenticated users to run arbitrary commands. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Exposure of Private Information in QNAP Q'center Virtual Appliance version 1.7.1063 and earlier could allow authenticated users to access sensitive information. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
QNAP has patched a remote code execution vulnerability affecting the QTS Media Library in all versions prior to QTS 4.2.6 build 20170905 and QTS 4.3.3.0299 build 20170901. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 51.1%.
GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of environment variables, which allows remote attackers to write to files or. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which allows remote attackers to execute arbitrary code via a crafted environment,. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
Authenticated cross-site scripting in QNAP's QuFTP Service allows a remote attacker who already holds a valid QuFTP user account to inject malicious script that executes in a victim's browser within the NAS web interface, potentially compromising the wider session context rather than the FTP service alone. The flaw affects QuFTP Service installations on QNAP NAS devices in branches prior to 1.4.6, 1.5.5, and 1.6.5, and successful exploitation additionally requires a victim to view the injected content. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the mandatory account prerequisite plus the user-interaction requirement are the principal limiters on real-world risk.
QNAP Notes Station 3 versions prior to 3.9.11 contain an OS command injection flaw (CWE-78) that permits unauthenticated network attackers to run arbitrary commands on a NAS where the optional Notes Station 3 add-on is installed and reachable. The vendor's CVSS 4.0 vector (6.9) indicates low confidentiality, integrity, and availability impact, suggesting the injected commands execute in a constrained context rather than granting full system control. No public exploit code has been identified at time of analysis, and the primary exposure is limited to internet-facing or broadly accessible NAS instances running the vulnerable add-on.
Authenticated remote attackers with a valid Qsync Central user account can exploit a unix symbolic link (symlink) following vulnerability (CWE-61) in QNAP Qsync Central to compromise system security, potentially leading to low impact on confidentiality, integrity, and availability. Affected versions are Qsync Central prior to 5.0.0.7, 5.1.0.3, 5.2.0.5, and 5.3.0.2. This medium-severity issue (CVSS 4.0 base 5.3) has no public exploit identified at time of analysis and requires the attacker to first obtain a valid account on the NAS.
Server-side request forgery in QNAP Download Station allows a low-privileged authenticated user to make the NAS application issue requests to internal or arbitrary destinations, resulting in limited disclosure of application data rather than any modification or denial of service. The flaw affects Download Station builds before 5.10.1.312 and the 5.11.x line before 5.11.2.321, and QNAP has published fixed versions for each branch. The issue is authentication-gated (CVSS 4.0 base 5.3, PR:L, confidentiality-only; independent assessment restricts impact to VC:L/VI:N/VA:N), and no public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis.
Denial of service in QNAP File Station 5 (versions prior to 5.5.6.5243) allows any authenticated user to trigger a NULL pointer dereference via a network request, causing availability impact only. Exploitation requires a valid File Station 5 account, is network-reachable with low complexity and no user interaction, and no public exploit has been identified at time of analysis. The vendor has released a patch in version 5.5.6.5243 and later.
Denial of service in QNAP File Station 5 affects installations running versions before 5.5.6.5243; an authenticated remote attacker with a valid NAS user account can send a crafted request that dereferences a NULL pointer and disrupts the File Station service. The issue is limited to availability (C:N/I:N/A:L), requires low privileges but no user interaction, and all available signals indicate low real-world priority; no public exploit code or confirmed active exploitation was identified at time of analysis, and QNAP has released File Station 5 5.5.6.5243 as the fixed version.
Authenticated denial of service in QNAP File Station 5 allows a remote attacker who already holds a valid low-privileged QNAP NAS user account to crash the File Station application by sending a crafted request that triggers a NULL pointer dereference (CWE-476); impact is confined to availability of that application, with no confidentiality or integrity loss. The affected code is the network-facing File Station service on NAS devices running versions before 5.5.6.5243, and the authentication prerequisite (PR:L in both the CNA and independently assessed vectors) confines realistic exploitation to malicious insiders or to attackers who have separately compromised a user login. No public exploit or proof-of-concept has been identified at time of analysis, the issue is not listed in CISA KEV, and no EPSS score was provided; the independent assessment confirms this is a genuinely low-priority issue despite being network-reachable.
Path traversal in QNAP Qsync Central allows an authenticated remote attacker to read the contents of unexpected files or system data. Exploitation requires a valid Qsync Central user account and results in low confidentiality impact with no integrity or availability loss. No public exploit identified at time of analysis, and the vendor has released patches in versions 5.0.0.7, 5.1.0.3, 5.2.0.5, and 5.3.0.2 and later.
A timing side-channel in QNAP QuRouter allows attackers on an adjacent network segment to extract limited sensitive data by measuring response-time discrepancies, without authentication and without user interaction. The issue is fixed in QuRouter 2.7.2.113 and later; the vendor advisory confirms a patched release is available. No public exploit code or active exploitation has been identified at time of analysis, and the scored risk is low (CVSS 4.0 base 1.3; independently assessed as CVSS 3.1 AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N), with the relevant confidentiality impact only and no integrity or availability effect.
Stored cross-site scripting in QNAP's Network & Virtual Switch component, shipped with QTS, QuTS hero, and QuTS cloud, lets an attacker who already holds a QNAP administrator account inject malicious script into the management interface, which then executes in the browser of another administrator who loads the affected page. Exploitation therefore requires two preconditions that are both confirmed by the CVSS vector (PR:H and UI:P): valid administrative credentials and victim interaction, which confines realistic impact to multi-administrator deployments where attackers can reach an already-authenticated peer. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the CVSS 4.0 base score is only 2.2, so this is a low-priority, post-compromise hardening issue rather than an externally exploitable entry point.
QuRouter 2.6.x devices below 2.6.4.001 contain a time-of-check time-of-use race condition that can allow an unauthenticated attacker on the same adjacent network segment to compromise confidentiality, integrity, and availability, but only if they win a timing-dependent race while a legitimate user operation is in progress. The vendor has released QuRouter 2.6.4.001 and later to fix the issue, and no public exploit was identified at time of analysis; the CVSS 4.0 base score is 7.5, though the adjacent-network, race-window, and user-interaction prerequisites substantially limit realistic exploitation.
Modification of protected system or configuration data in QNAP QuRouter is possible when a local attacker who already holds a QuRouter administrator account abuses an external-control-of-configuration flaw (CWE-15). This is an authenticated, local-only issue with low integrity impact and no confidentiality or availability impact; there is no remote or unauthenticated path. QNAP fixed it in QuRouter 2.7.2.113 and later, and no public exploit code has been identified at time of analysis.
Path traversal (CWE-22) in QNAP Video Station 5.8.x before 5.8.5 lets an authenticated remote user escape the application's intended media directory and read unexpected files or system data on the underlying NAS. The attacker must first hold a valid account on the target QNAP device (CVSS 3.1 PR:L), so exposure is limited to holders of legitimate low-privilege credentials or anyone able to register or compromise such an account; the vendor's CVSS 4.0 vector additionally carries the AT:P flag, indicating an attack requirement outside the attacker's direct control. There is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis, and QNAP has already released a fixed version, so this is a moderate-priority issue that nevertheless warrants prompt patching on internet-exposed NAS devices with open registration or weak accounts.
Authenticated path traversal in QNAP Video Station 5.8.x (fixed in 5.8.5) allows a low-privilege NAS user to read files and system data outside the intended application directory. The flaw requires a valid Video Station login (CVSS PR:L) plus the vendor's stated attack precondition (AT:P), and its impact is limited to information disclosure rather than code execution. No public exploit has been identified at time of analysis, and the practical risk is moderate: a real but constrained, authenticated file-read issue rather than a critical remotely weaponizable bug.
Authenticated buffer overflow in QNAP Qsync Central (the QsyncServer app on QNAP NAS devices) prior to 5.0.0.4 allows a remote attacker who already holds a valid Qsync Central user account to corrupt memory or crash the Qsync process, degrading availability with no confirmed path to data theft or modification. The vulnerability is a classic CWE-120 buffer copy without input-size checking, and the assessed CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/C:N/I:N/A:L) confirms the impact is availability-only and gated behind account possession. There is no public exploit identified at time of analysis, no evidence of active exploitation, and an official fix is available in Qsync Central 5.0.0.4 and later, making this a low-priority, readily remediated issue.
Denial of service in QNAP Qsync Central before 5.0.0.4 can be triggered by an authenticated low-privileged user who reaches a NULL pointer dereference in the service. The vendor has fixed the issue in Qsync Central 5.0.0.4 and later, no public exploit identified at time of analysis, and the independent assessment rates this as a genuinely low-priority, availability-only issue.
Stack-based buffer overflow in QNAP File Station 5 enables remote unauthenticated attackers to corrupt memory or destabilize processes through a network-accessible attack path requiring only passive user interaction. Affected versions are all releases prior to 5.5.6.5243; QNAP's own security team (security@qnapsecurity.com.tw) discovered and disclosed the issue via advisory QSA-26-27. No public exploit code exists and the vulnerability is not listed in CISA KEV; however, the unauthenticated network attack vector lowers the bar for opportunistic targeting of QNAP NAS deployments.
Stack-based buffer overflow in QNAP File Station 5 allows unauthenticated remote attackers to corrupt process memory or crash the file management service when a victim user passively interacts with a crafted input. Affected versions are all File Station 5 releases prior to 5.5.6.5243, running on QNAP NAS devices accessible over the network. No public exploit code has been identified and this CVE is not listed in the CISA KEV catalog; QNAP has confirmed and released a fix in version 5.5.6.5243 via advisory QSA-26-32.
Authenticated command injection in QNAP QTS and QuTS hero NAS operating systems allows an attacker who already holds an administrator account to execute arbitrary OS commands on the appliance. The flaw carries a CVSS 4.0 score of 8.6, but the PR:H requirement substantially narrows the attacker population; no public exploit identified at time of analysis and the issue is not listed in CISA KEV. QNAP has shipped fixed builds (QTS 5.2.9.3492 build 20260507 and QuTS hero h5.2.9.3499 build 20260514).
Path traversal in QNAP QTS and QuTS hero NAS operating systems exposes arbitrary file contents to attackers who have already obtained administrator-level access. The root cause (CWE-22) indicates insufficient sanitization of file path inputs, allowing directory escape to reach files outside intended scope. No public exploit code has been identified at time of analysis, and CISA KEV lists no active exploitation - making this a targeted post-compromise risk rather than an opportunistic mass-exploitation scenario. Vendor-released patches address all affected branches as of May 2026.
NULL pointer dereference in QNAP QTS and QuTS hero NAS operating systems enables a remote, administrator-authenticated attacker to trigger a denial-of-service condition. Exploitation requires the attacker to first hold or acquire an administrator account on the target device, after which a crafted request can crash system services. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog at time of analysis.
NULL pointer dereference in QNAP QTS and QuTS hero NAS operating systems allows remote unauthenticated attackers to crash a network-facing service and cause a denial-of-service condition without any authentication or user interaction. Multiple active OS branches are affected - QTS 5.2.x and QuTS hero h5.2.x through h6.0.x - across a device population that is historically internet-exposed and frequently targeted. No public exploit has been identified and this vulnerability is not listed in CISA KEV, but the zero-authentication, network-accessible attack surface makes DoS attempts trivially repeatable against unpatched devices.
Integer overflow (CWE-190) in QNAP QTS and QuTS hero NAS operating systems allows a remote attacker who has already obtained an administrator account to further compromise system integrity and availability. Affected versions span QTS 5.2.x and QuTS hero h5.2.x through h6.0.x; QNAP released patched builds in February and May 2026. No public exploit code and no CISA KEV listing have been identified at time of analysis, and the mandatory prerequisite of administrator-level access materially constrains real-world exploitability.
Authenticated command injection in QNAP QTS and QuTS hero allows a remote attacker holding administrator credentials to execute arbitrary OS commands on the NAS appliance. The CVSS 4.0 base score of 8.6 reflects high impact across confidentiality, integrity, and availability, though exploitation requires high privileges (PR:H). No public exploit has been identified at time of analysis, and the issue is not listed in CISA KEV; QNAP has released fixed builds across affected QTS and QuTS hero branches.
Authenticated command injection in QNAP QTS and QuTS hero NAS operating systems allows a remote attacker who has already obtained administrator credentials to execute arbitrary OS commands on the appliance. Reported by QNAP itself and tracked as EUVD-2025-210099, the issue affects multiple branches across QTS 5.2.x and QuTS hero 5.2.x, 5.3.x, and 6.0.x and is fixed in builds dated 2026-02-06 through 2026-05-20. No public exploit identified at time of analysis and the issue is not listed in CISA KEV.
NULL pointer dereference in QNAP QuTS hero NAS operating system allows a remote attacker who has already obtained or possesses an administrator account to trigger a denial-of-service condition, crashing affected services. Affected branches span QuTS hero h5.2.x, h5.3.x, and h6.0.x series, with vendor-released patches available as of early-to-mid 2026. No public exploit code or CISA KEV listing has been identified at time of analysis, and the mandatory prerequisite of high-privilege authentication substantially constrains real-world impact.
Stack-based buffer overflow in QNAP QTS and QuTS hero NAS operating systems enables an authenticated administrator to corrupt stack memory or crash processes via a network-accessible attack path. Affected versions span QTS 5.2.x and multiple QuTS hero release trains (h5.2.x, h5.3.x, h6.0.x), with vendor-released patches dated February-May 2026. No public exploit code and no CISA KEV listing have been identified at time of analysis, and the mandatory high-privilege prerequisite substantially limits realistic attack surface.
Cross-site scripting in QNAP QTS and QuTS hero operating systems allows remote attackers to bypass security mechanisms and read application data when an authenticated user interacts with attacker-supplied content. The flaw carries a CVSS 4.0 score of 8.7 driven by network reachability, low attack complexity, no required privileges, and high impact across confidentiality, integrity, and availability of the NAS management surface. There is no public exploit identified at time of analysis and the vulnerability is not listed in CISA KEV.
QNAP Hyper Data Protector before 2.3.1.455 contains hard-coded credentials that allow remote unauthenticated attackers to gain unauthorized access to backup management functions, potentially compromising all backed-up data across the organization.
A command injection vulnerability has been reported to affect several QNAP operating system versions. If an attacker gains local network access who have also gained a user account, they can then exploit the vulnerability to execute arbitrary commands. [CVSS 7.8 HIGH]
An SQL injection vulnerability has been reported to affect Video Station. If an attacker gains local network access who have also gained an administrator account, they can then exploit the vulnerability to execute unauthorized code or commands.
An improper certificate validation vulnerability has been reported to affect Video Station. If an attacker gains local network access who have also gained an administrator account, they can then exploit the vulnerability to compromise the security of the system.
File Station 6 contains a path traversal vulnerability that allows authenticated attackers to read arbitrary files and system data on affected systems. An attacker with valid user credentials can exploit this flaw to access sensitive information beyond intended restrictions. No patch is currently available for File Station 6, though File Station 5.5.6.5190 and later versions have been remediated.
A path traversal vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data. [CVSS 6.5 MEDIUM]
A path traversal vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data. [CVSS 6.5 MEDIUM]
Symlink following vulnerability in multiple QNAP NAS operating system versions allows remote attackers to exploit link resolution for unauthorized access.
A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack. [CVSS 4.9 MEDIUM]
A path traversal vulnerability has been reported to affect File Station 5. If a local attacker gains an administrator account, they can then exploit the vulnerability to read the contents of unexpected files or system data. [CVSS 4.4 MEDIUM]
A path traversal vulnerability has been reported to affect File Station 5. If a local attacker gains an administrator account, they can then exploit the vulnerability to read the contents of unexpected files or system data. [CVSS 4.4 MEDIUM]
An uncontrolled resource consumption vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack. [CVSS 6.5 MEDIUM]
A path traversal vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data. [CVSS 6.5 MEDIUM]
A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack. [CVSS 4.9 MEDIUM]
A NULL pointer dereference vulnerability has been reported to affect Qsync Central. If a remote attacker gains an administrator account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack. [CVSS 4.9 MEDIUM]
An allocation of resources without limits or throttling vulnerability has been reported to affect Qsync Central. If a remote attacker gains an administrator account, they can then exploit the vulnerability to prevent other systems, applications, or processes from accessing the same type of resource. [CVSS 4.9 MEDIUM]
A path traversal vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data. [CVSS 6.5 MEDIUM]
A relative path traversal vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data. [CVSS 6.5 MEDIUM]
A use of uninitialized variable vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to denial of service conditions, or modify control flow in unexpected ways. [CVSS 4.9 MEDIUM]
A weak authentication vulnerability has been reported to affect File Station 5. The remote attackers can then exploit the vulnerability to gain sensitive information. [CVSS 7.5 HIGH]
An allocation of resources without limits or throttling vulnerability has been reported to affect Qsync Central. If a remote attacker gains an administrator account, they can then exploit the vulnerability to prevent other systems, applications, or processes from accessing the same type of resource. [CVSS 4.9 MEDIUM]
An allocation of resources without limits or throttling vulnerability has been reported to affect Qsync Central. If a remote attacker gains an administrator account, they can then exploit the vulnerability to prevent other systems, applications, or processes from accessing the same type of resource. [CVSS 4.9 MEDIUM]
A buffer overflow vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to modify memory or crash processes. [CVSS 8.1 HIGH]
An allocation of resources without limits or throttling vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to prevent other systems, applications, or processes from accessing the same type of resource. [CVSS 6.5 MEDIUM]
An improper neutralization of directives in statically saved code ('Static Code Injection') vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit the vulnerability to access restricted data / files. [CVSS 8.8 HIGH]
An out-of-bounds read vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to obtain secret data. [CVSS 6.5 MEDIUM]
An out-of-bounds read vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit the vulnerability to obtain secret data. [CVSS 6.5 MEDIUM]
A NULL pointer dereference vulnerability has been reported to affect File Station 5. If a remote attacker gains an administrator account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack. [CVSS 4.9 MEDIUM]
A path traversal vulnerability has been reported to affect File Station 5. If a remote attacker gains an administrator account, they can then exploit the vulnerability to read the contents of unexpected files or system data. [CVSS 4.9 MEDIUM]
An allocation of resources without limits or throttling vulnerability has been reported to affect File Station 5. [CVSS 4.9 MEDIUM]
An allocation of resources without limits or throttling vulnerability has been reported to affect File Station 5. [CVSS 4.9 MEDIUM]
A use of out-of-range pointer offset vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to read sensitive portions of memory. [CVSS 6.5 MEDIUM]
An uncontrolled resource consumption vulnerability has been reported to affect Qsync Central. If a local attacker gains a user account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack. [CVSS 5.5 MEDIUM]
An uncontrolled resource consumption vulnerability has been reported to affect Qsync Central. If a local attacker gains a user account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack. [CVSS 5.5 MEDIUM]
An uncontrolled resource consumption vulnerability has been reported to affect Qsync Central. If a local attacker gains a user account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack. [CVSS 5.5 MEDIUM]
A NULL pointer dereference vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack. [CVSS 6.5 MEDIUM]
A NULL pointer dereference vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack. [CVSS 6.5 MEDIUM]