Read the docs

QNAP

Records682All Threatist records
Exploited (KEV)14In CISA KEV
CVSS critical101CVSS 9.0–10.0
CVSS high234CVSS 7.0–8.9

Exploited now

QNAP records in CISA KEV
TI-2023-25733 QNAP VioStor NVR OS Command Injection Vulnerability Priority CRITICAL 97KEV 2023-12-21TI-2022-10581 QNAP Photo Station Externally Controlled Reference Vulnerability Priority CRITICAL 100KEV 2022-09-08TI-2019-05100 QNAP Photo Station Improper Access Control Vulnerability Priority CRITICAL 100KEV 2022-06-08TI-2019-05101 QNAP QTS Improper Input Validation Vulnerability Priority CRITICAL 100KEV 2022-06-08TI-2019-05102 QNAP Photo Station Path Traversal Vulnerability Priority CRITICAL 100KEV 2022-06-08TI-2019-05103 QNAP Photo Station Path Traversal Vulnerability Priority CRITICAL 100KEV 2022-06-08

Components

Products in the NVD configurations · select one to filter the records
Qts 283 records CRITICAL Quts Hero 234 records CRITICAL Qsync Central 62 records MEDIUM Qutscloud 62 records HIGH File Station 57 records LOW Photo Station 26 records CRITICAL Video Station 21 records MEDIUM Media Streaming Add-on 13 records MEDIUM

Records

13 records in Media Streaming Add-on · all components

TI-2023-09215 CVE-2023-23369 · GHSA-5p75-fm4f-6c3v

Command injection in QNAP Multimedia Console

Priority MEDIUM 58

An OS command injection vulnerability has been reported to affect several QNAP operating system versions.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.1415 Published 2023-11-03 Fixed in 2.1.2 ( 2023/05/04 ), 1.4.8 ( 2023/05/05 ) +7 CWE-77
TI-2017-05276 CVE-2017-7640 · GHSA-7cpj-mvjh-6pqf

OS command injection in QNAP Media Streaming Add-On

Priority MEDIUM 48

QNAP NAS application Media Streaming add-on version 421.1.0.2, 430.1.2.0, and earlier allows remote attackers to run arbitrary OS commands against the system with root privileges.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.03108 Published 2018-03-08 No fix listed CWE-78
TI-2023-25540 CVE-2023-47222 · GHSA-7mfg-57xp-v6gq

Information disclosure in QNAP Media Streaming add-on

Priority MEDIUM 44

An exposure of sensitive information vulnerability has been reported to affect Media Streaming add-on.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00544 Published 2024-04-26 Fixed in 500.1.1.5 ( 2024/01/22 ) CWE-200
TI-2021-13401 CVE-2021-34362 · GHSA-rfgr-8gxv-c42h

Command Injection Vulnerability in Media Streaming Add-on

Priority MEDIUM 40

A command injection vulnerability has been reported to affect QNAP device running Media Streaming add-on.

CVSS 3.1HIGH 8.7 Network High privileges No interaction EPSS 0.01266 Published 2021-10-22 Fixed in 500.0.0.3 ( 2021/08/20 ), 430.1.8.12 ( 2021/08/20 ) +1 CWE-78
TI-2024-33828 CVE-2024-50395 · GHSA-7r8m-5c4m-7j6c

Authorization bypass in QNAP Media Streaming add-on

Priority LOW 35

An authorization bypass through user-controlled key vulnerability has been reported to affect Media Streaming add-on.

CVSS 4.0MEDIUM 6.9 Network No auth User interaction EPSS 0.0136 Published 2024-11-22 Fixed in 500.1.1.6 ( 2024/08/02 ) CWE-639
TI-2023-25538 CVE-2023-47220 · GHSA-q5v5-v9rx-98qf

OS command injection in QNAP Media Streaming add-on

Priority LOW 32

An OS command injection vulnerability has been reported to affect Media Streaming add-on.

CVSS 3.1MEDIUM 6.6 Network High privileges No interaction EPSS 0.01191 Published 2024-05-03 Fixed in 500.1.1.5 ( 2024/01/22 ) CWE-78
TI-2017-05274 CVE-2017-7638 · GHSA-jm5g-5386-4p5f

Improper authentication in QNAP Media Streaming Add-On

Priority LOW 30

QNAP NAS application Media Streaming add-on version 421.1.0.2, 430.1.2.0, and earlier does not authenticate requests properly.

CVSS 3.0MEDIUM 6.5 Network No auth No interaction EPSS 0.0067 Published 2018-03-08 No fix listed CWE-287
TI-2017-05270 CVE-2017-7634 · GHSA-5g4h-rvhm-8jcr

Cross-site scripting in QNAP Media Streaming Add-On

Priority LOW 29

Cross-site scripting (XSS) vulnerability in QNAP NAS application Media Streaming add-on version 421.1.0.2, 430.1.2.0, and earlier allows remote attackers to inject arbitrary web script or HTML.

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.00757 Published 2018-03-08 No fix listed CWE-79
TI-2024-37676 CVE-2024-56808 · GHSA-h7qq-mch4-gjx3

OS command injection in QNAP Media Streaming add-on

Priority LOW 14

A command injection vulnerability has been reported to affect Media Streaming add-on.

CVSS 4.0LOW 2.0 Physical Low privileges No interaction EPSS 0.00646 Published 2026-02-11 Fixed in 500.1.1.6 ( 2024/08/02 ) CWE-78
TI-2024-37675 CVE-2024-56807 · GHSA-h3fv-27fp-2c8j

Out-of-bounds read in QNAP Media Streaming add-on

Priority LOW 9

An out-of-bounds read vulnerability has been reported to affect Media Streaming add-on.

CVSS 4.0LOW 1.7 Physical No auth No interaction EPSS 0.00127 Published 2026-02-11 Fixed in 500.1.1.6 ( 2024/08/02 ) CWE-125
Open these records in search →