Video Station
Monthly
Unauthenticated remote attackers can read sensitive data from QNAP NAS devices running the optional Video Station (VideoStationPro) application prior to 5.8.8 by exploiting a CWE-639 authorization bypass through a user-controlled key. The vendor rates the flaw 8.7 under CVSS 4.0 (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N) and our independent assessment scores it 7.5 under CVSS 3.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), reflecting a confidentiality-only impact with no integrity or availability loss. Exploitation requires Video Station to be installed and network-reachable on a QTS/QuTS NAS, and no public exploit code or CISA KEV listing was identified at time of analysis, so this is a high-priority information-disclosure issue rather than a confirmed actively exploited one.
Authenticated path traversal in QNAP Video Station before 5.8.8 allows a remote attacker with a valid low-privileged user account to read arbitrary files and system data outside the intended application directory. The flaw is CWE-22 and requires network access with low complexity and no user interaction, but the PR:L vector means an attacker must first hold a Video Station account, limiting mass exploitation. no public exploit identified at time of analysis, and QNAP has released Video Station 5.8.8 as the fix. The vendor CVSS 4.0 score is 8.7, but independent assessment scopes impact to confidentiality only, so it is a genuine moderate-priority issue rather than a top-tier emergency.
SQL injection in QNAP Video Station before version 5.8.8 lets a remote attacker who already holds a valid Video Station user account inject arbitrary SQL into the application's database queries, exposing stored data with high confidentiality impact and a limited availability effect. The vendor-reported vector (CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L, 7.1) and our independent assessment (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L) agree that the vulnerability is network-reachable, low complexity and requires no user interaction, but that the attacker must first authenticate as a Video Station user - this authentication prerequisite is the main limiting factor and rules out fully unauthenticated internet exploitation. There is no public exploit identified at time of analysis, and QNAP has already shipped a fix in Video Station 5.8.8 and later, so risk is highest for NAS devices that expose Video Station to untrusted networks and provision multiple or guest-level accounts.
SQL injection in QNAP Video Station (versions prior to 5.8.8) allows a remote attacker who already holds a valid NAS user account to read sensitive data from the application's backend database through the Video Station web interface. The flaw is an authenticated issue (CVSS PR:L), and the independent assessment bounds the impact to confidentiality only (C:H), meaning it does not by itself provide code execution or service disruption despite the description's broader wording. No public exploit code was identified at time of analysis, and the vendor has released a fix in Video Station 5.8.8 and later.
Path traversal (CWE-22) in QNAP Video Station 5.8.x before 5.8.5 lets an authenticated remote user escape the application's intended media directory and read unexpected files or system data on the underlying NAS. The attacker must first hold a valid account on the target QNAP device (CVSS 3.1 PR:L), so exposure is limited to holders of legitimate low-privilege credentials or anyone able to register or compromise such an account; the vendor's CVSS 4.0 vector additionally carries the AT:P flag, indicating an attack requirement outside the attacker's direct control. There is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis, and QNAP has already released a fixed version, so this is a moderate-priority issue that nevertheless warrants prompt patching on internet-exposed NAS devices with open registration or weak accounts.
Authenticated path traversal in QNAP Video Station 5.8.x (fixed in 5.8.5) allows a low-privilege NAS user to read files and system data outside the intended application directory. The flaw requires a valid Video Station login (CVSS PR:L) plus the vendor's stated attack precondition (AT:P), and its impact is limited to information disclosure rather than code execution. No public exploit has been identified at time of analysis, and the practical risk is moderate: a real but constrained, authenticated file-read issue rather than a critical remotely weaponizable bug.
An SQL injection vulnerability has been reported to affect Video Station. If an attacker gains local network access who have also gained an administrator account, they can then exploit the vulnerability to execute unauthorized code or commands.
An improper certificate validation vulnerability has been reported to affect Video Station. If an attacker gains local network access who have also gained an administrator account, they can then exploit the vulnerability to compromise the security of the system.
An SQL injection vulnerability has been reported to affect Video Station. If a remote attacker gains a user account, they can then exploit the vulnerability to execute unauthorized code or commands. We have already fixed the vulnerability in the following version: Video Station 5.8.4 and later
An OS command injection vulnerability has been reported to affect Video Station. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A SQL injection vulnerability has been reported to affect Video Station. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A cross-site scripting (XSS) vulnerability has been reported to affect Video Station. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A SQL injection vulnerability has been reported to affect Video Station. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
An OS command injection vulnerability has been reported to affect several QNAP operating system versions. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A command injection vulnerability has been reported to affect certain versions of Video Station. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Server-Side Request Forgery (SSRF) vulnerability in webapi component in Synology Video Station before 2.4.10-1632 allows remote authenticated users to send arbitrary request to intranet resources via. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
This cross-site scripting (XSS) vulnerability in Video Station allows remote attackers to inject and execute scripts on the administrator’s management console. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
QNAP has already patched this vulnerability. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Cross-site scripting (XSS) vulnerability in Video Metadata Editor in Synology Video Station before 2.3.0-1435 allows remote authenticated attackers to inject arbitrary web script or HTML via the. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Multiple cross-site scripting (XSS) vulnerabilities in Synology Video Station 1.2 before 1.2-0455, 1.5 before 1.5-0772, and 1.6 before 1.6-0847 allow remote authenticated attackers to inject. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Synology Video Station before 1.5-0763 allows remote attackers to execute arbitrary shell commands via shell metacharacters in the subtitle_codepage parameter to subtitle.cgi. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 29.7%.
SQL injection vulnerability in Synology Video Station before 1.5-0763 allows remote attackers to execute arbitrary SQL commands via the id parameter to watchstatus.cgi. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
SQL injection vulnerability in Synology Video Station before 1.5-0757 allows remote attackers to execute arbitrary SQL commands via the id parameter to audiotrack.cgi. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Unauthenticated remote attackers can read sensitive data from QNAP NAS devices running the optional Video Station (VideoStationPro) application prior to 5.8.8 by exploiting a CWE-639 authorization bypass through a user-controlled key. The vendor rates the flaw 8.7 under CVSS 4.0 (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N) and our independent assessment scores it 7.5 under CVSS 3.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), reflecting a confidentiality-only impact with no integrity or availability loss. Exploitation requires Video Station to be installed and network-reachable on a QTS/QuTS NAS, and no public exploit code or CISA KEV listing was identified at time of analysis, so this is a high-priority information-disclosure issue rather than a confirmed actively exploited one.
Authenticated path traversal in QNAP Video Station before 5.8.8 allows a remote attacker with a valid low-privileged user account to read arbitrary files and system data outside the intended application directory. The flaw is CWE-22 and requires network access with low complexity and no user interaction, but the PR:L vector means an attacker must first hold a Video Station account, limiting mass exploitation. no public exploit identified at time of analysis, and QNAP has released Video Station 5.8.8 as the fix. The vendor CVSS 4.0 score is 8.7, but independent assessment scopes impact to confidentiality only, so it is a genuine moderate-priority issue rather than a top-tier emergency.
SQL injection in QNAP Video Station before version 5.8.8 lets a remote attacker who already holds a valid Video Station user account inject arbitrary SQL into the application's database queries, exposing stored data with high confidentiality impact and a limited availability effect. The vendor-reported vector (CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L, 7.1) and our independent assessment (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L) agree that the vulnerability is network-reachable, low complexity and requires no user interaction, but that the attacker must first authenticate as a Video Station user - this authentication prerequisite is the main limiting factor and rules out fully unauthenticated internet exploitation. There is no public exploit identified at time of analysis, and QNAP has already shipped a fix in Video Station 5.8.8 and later, so risk is highest for NAS devices that expose Video Station to untrusted networks and provision multiple or guest-level accounts.
SQL injection in QNAP Video Station (versions prior to 5.8.8) allows a remote attacker who already holds a valid NAS user account to read sensitive data from the application's backend database through the Video Station web interface. The flaw is an authenticated issue (CVSS PR:L), and the independent assessment bounds the impact to confidentiality only (C:H), meaning it does not by itself provide code execution or service disruption despite the description's broader wording. No public exploit code was identified at time of analysis, and the vendor has released a fix in Video Station 5.8.8 and later.
Path traversal (CWE-22) in QNAP Video Station 5.8.x before 5.8.5 lets an authenticated remote user escape the application's intended media directory and read unexpected files or system data on the underlying NAS. The attacker must first hold a valid account on the target QNAP device (CVSS 3.1 PR:L), so exposure is limited to holders of legitimate low-privilege credentials or anyone able to register or compromise such an account; the vendor's CVSS 4.0 vector additionally carries the AT:P flag, indicating an attack requirement outside the attacker's direct control. There is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis, and QNAP has already released a fixed version, so this is a moderate-priority issue that nevertheless warrants prompt patching on internet-exposed NAS devices with open registration or weak accounts.
Authenticated path traversal in QNAP Video Station 5.8.x (fixed in 5.8.5) allows a low-privilege NAS user to read files and system data outside the intended application directory. The flaw requires a valid Video Station login (CVSS PR:L) plus the vendor's stated attack precondition (AT:P), and its impact is limited to information disclosure rather than code execution. No public exploit has been identified at time of analysis, and the practical risk is moderate: a real but constrained, authenticated file-read issue rather than a critical remotely weaponizable bug.
An SQL injection vulnerability has been reported to affect Video Station. If an attacker gains local network access who have also gained an administrator account, they can then exploit the vulnerability to execute unauthorized code or commands.
An improper certificate validation vulnerability has been reported to affect Video Station. If an attacker gains local network access who have also gained an administrator account, they can then exploit the vulnerability to compromise the security of the system.
An SQL injection vulnerability has been reported to affect Video Station. If a remote attacker gains a user account, they can then exploit the vulnerability to execute unauthorized code or commands. We have already fixed the vulnerability in the following version: Video Station 5.8.4 and later
An OS command injection vulnerability has been reported to affect Video Station. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A SQL injection vulnerability has been reported to affect Video Station. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A cross-site scripting (XSS) vulnerability has been reported to affect Video Station. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A SQL injection vulnerability has been reported to affect Video Station. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
An OS command injection vulnerability has been reported to affect several QNAP operating system versions. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A command injection vulnerability has been reported to affect certain versions of Video Station. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Server-Side Request Forgery (SSRF) vulnerability in webapi component in Synology Video Station before 2.4.10-1632 allows remote authenticated users to send arbitrary request to intranet resources via. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
This cross-site scripting (XSS) vulnerability in Video Station allows remote attackers to inject and execute scripts on the administrator’s management console. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
QNAP has already patched this vulnerability. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Cross-site scripting (XSS) vulnerability in Video Metadata Editor in Synology Video Station before 2.3.0-1435 allows remote authenticated attackers to inject arbitrary web script or HTML via the. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Multiple cross-site scripting (XSS) vulnerabilities in Synology Video Station 1.2 before 1.2-0455, 1.5 before 1.5-0772, and 1.6 before 1.6-0847 allow remote authenticated attackers to inject. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Synology Video Station before 1.5-0763 allows remote attackers to execute arbitrary shell commands via shell metacharacters in the subtitle_codepage parameter to subtitle.cgi. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 29.7%.
SQL injection vulnerability in Synology Video Station before 1.5-0763 allows remote attackers to execute arbitrary SQL commands via the id parameter to watchstatus.cgi. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
SQL injection vulnerability in Synology Video Station before 1.5-0757 allows remote attackers to execute arbitrary SQL commands via the id parameter to audiotrack.cgi. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.