Smedio Dtcp Move
Monthly
Missing authentication in sMedio DTCP MOVE before version 1.4.5 lets remote, unauthenticated attackers reach critical functions of the DTCP-IP content-transfer service (sMedioDTCPServer) running on QNAP NAS devices, yielding high impact to confidentiality, integrity and availability (vendor CVSS 4.0 base 9.3; independent assessment CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). The vendor has shipped a fixed release (1.4.5 and later), and no public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis. Real-world exposure is limited mainly by deployment scarcity - this is an optional, niche QNAP add-on rather than a default NAS service - and by whether the affected service is network-reachable rather than confined behind NAT or a segmented LAN.
Missing authentication in sMedio DTCP MOVE before version 1.4.5 lets remote, unauthenticated attackers reach critical functions of the DTCP-IP content-transfer service (sMedioDTCPServer) running on QNAP NAS devices, yielding high impact to confidentiality, integrity and availability (vendor CVSS 4.0 base 9.3; independent assessment CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). The vendor has shipped a fixed release (1.4.5 and later), and no public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis. Real-world exposure is limited mainly by deployment scarcity - this is an optional, niche QNAP add-on rather than a default NAS service - and by whether the affected service is network-reachable rather than confined behind NAT or a segmented LAN.