Virtualization Station
Monthly
Improper link resolution (CWE-59) in QNAP Virtualization Station before 4.1.1.130 allows an authenticated remote attacker with a low-privilege user account to manipulate a symbolic link that is later followed by a privileged file operation, achieving high confidentiality, integrity, and availability impact (CVSS 8.7). This is a credible, elevated-priority issue for environments running the Virtualization Station (QKVM) add-on, though not a drop-everything emergency; exploitation requires the app to be installed and the attacker to hold a valid low-privilege account, and no public exploit code or active exploitation (KEV) has been identified at time of analysis. Upgrade to 4.1.1.130 or later to remediate.
Improper link resolution (CWE-59) in QNAP Virtualization Station before 4.1.1.130 allows an authenticated remote attacker with a low-privilege user account to manipulate a symbolic link that is later followed by a privileged file operation, achieving high confidentiality, integrity, and availability impact (CVSS 8.7). This is a credible, elevated-priority issue for environments running the Virtualization Station (QKVM) add-on, though not a drop-everything emergency; exploitation requires the app to be installed and the attacker to hold a valid low-privilege account, and no public exploit code or active exploitation (KEV) has been identified at time of analysis. Upgrade to 4.1.1.130 or later to remediate.