Read the docs

QNAP

Records682All Threatist records
Exploited (KEV)14In CISA KEV
CVSS critical101CVSS 9.0–10.0
CVSS high234CVSS 7.0–8.9

Exploited now

QNAP records in CISA KEV
TI-2023-25733 QNAP VioStor NVR OS Command Injection Vulnerability Priority CRITICAL 97KEV 2023-12-21TI-2022-10581 QNAP Photo Station Externally Controlled Reference Vulnerability Priority CRITICAL 100KEV 2022-09-08TI-2019-05100 QNAP Photo Station Improper Access Control Vulnerability Priority CRITICAL 100KEV 2022-06-08TI-2019-05101 QNAP QTS Improper Input Validation Vulnerability Priority CRITICAL 100KEV 2022-06-08TI-2019-05102 QNAP Photo Station Path Traversal Vulnerability Priority CRITICAL 100KEV 2022-06-08TI-2019-05103 QNAP Photo Station Path Traversal Vulnerability Priority CRITICAL 100KEV 2022-06-08

Components

Products in the NVD configurations · select one to filter the records
Qts 283 records CRITICAL Quts Hero 234 records CRITICAL Qsync Central 62 records MEDIUM Qutscloud 62 records HIGH File Station 57 records LOW Photo Station 26 records CRITICAL Video Station 21 records MEDIUM Media Streaming Add-on 13 records MEDIUM

Records

283 records in Qts · all components

TI-2020-02221 CVE-2020-2509 · GHSA-77jf-5mcg-g6m9

Command Injection Vulnerability in QTS and QuTS hero

Priority CRITICAL 100KEV

A command injection vulnerability has been reported to affect QTS and QuTS hero.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.33987 Published 2021-04-17 Fixed in 4.5.2.1566 Build 20210202, 4.5.1.1495 Build 20201123 +5 CWE-77
TI-2019-05101 CVE-2019-7193 · GHSA-964w-hfj4-c2g7

Improper input validation in QNAP NAS devices

Priority CRITICAL 100KEV

This improper input validation vulnerability allows remote attackers to inject arbitrary code to the system.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.14367 Published 2019-12-05 No fix listed CWE-20
TI-2018-14137 CVE-2018-19949 · GHSA-h9cw-v634-8jcw

Improper input validation in QNAP QTS

Priority CRITICAL 100KEV

If exploited, this command injection vulnerability could allow remote attackers to run arbitrary commands.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.3016 Published 2020-10-28 Fixed in 4.4.2.1231, 4.4.1.1201 +4 CWE-20
TI-2014-05975 CVE-2014-7169 · GHSA-f7j6-xrjp-vffg

GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed…

Priority CRITICAL 100KEV

GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of environment variables, which allows remote attackers to write to files or possibly have unknown oth…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.9994 Published 2014-09-25 Fixed CWE-78
TI-2014-05157 CVE-2014-6271 · GHSA-6hfc-grwp-2p9c

GNU Bash through 4.3 processes trailing strings after function definitions in the values…

Priority CRITICAL 100KEV

GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which allows remote attackers to execute arbitrary code via a crafted environment, as demonstrated by vec…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.99999 Published 2014-09-24 Fixed CWE-78
TI-2018-14131 CVE-2018-19943 · GHSA-wh89-fj9h-4gr8

Cross-site scripting in QNAP QTS

Priority CRITICAL 94KEV

If exploited, this cross-site scripting vulnerability could allow remote attackers to inject malicious code.

CVSS 3.1HIGH 8.0 Network Low privileges User interaction EPSS 0.22682 Published 2020-10-28 Fixed in 4.4.2.1270, 4.4.1.1261 +4 CWE-79
TI-2018-14141 CVE-2018-19953 · GHSA-8h8x-7j55-4jp9

Cross-site scripting in QNAP QTS

Priority CRITICAL 86KEV

If exploited, this cross-site scripting vulnerability could allow remote attackers to inject malicious code.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.30527 Published 2020-10-28 Fixed in 4.4.2.1231, 4.4.1.1201 +4 CWE-79
TI-2023-25536 CVE-2023-47218 · GHSA-j269-5p85-wxpq

Command injection in QNAP QTS

Priority HIGH 79

An OS command injection vulnerability has been reported to affect several QNAP operating system versions.

CVSS 3.1HIGH 8.3 Network No auth No interaction EPSS 0.8992 Published 2024-02-13 Fixed in 5.1.5.2645 build 20240116, 4.x +3 CWE-77
TI-2024-35889 CVE-2024-53691 · GHSA-6hfr-hxpf-c7m6

Link following in QNAP QTS

Priority HIGH 73

A link following vulnerability has been reported to affect several QNAP operating system versions.

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.23758 Published 2024-12-06 Fixed in 5.1.8.2823 build 20240712, 5.2.0.2802 build 20240620 +2 CWE-59
TI-2024-17986 CVE-2024-27130 · GHSA-c3mm-2w2h-vx43

Buffer overflow in QNAP QTS

Priority HIGH 73

A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.3752 Published 2024-05-21 Fixed in 5.1.7.2770 build 20240520, h5.1.7.2770 build 20240520 CWE-120
TI-2024-14559 CVE-2024-21899 · GHSA-mfjq-7ffc-qgmv

Improper authentication in QNAP QTS

Priority HIGH 70

An improper authentication vulnerability has been reported to affect several QNAP operating system versions.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.24365 Published 2024-03-08 Fixed in 5.1.3.2578 build 20231110, 4.5.4.2627 build 20231225 +3 CWE-287
TI-2023-09214 CVE-2023-23368 · GHSA-vccx-mhx2-8xvf

OS command injection in QNAP QTS

Priority HIGH 67

An OS command injection vulnerability has been reported to affect several QNAP operating system versions.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.18363 Published 2023-11-03 Fixed in 5.0.1.2376 build 20230421, 4.5.4.2374 build 20230416 +3 CWE-78
TI-2023-28022 CVE-2023-51364 · GHSA-pvq7-259f-j6f4

Path traversal in QNAP QTS

Priority HIGH 65

A path traversal vulnerability has been reported to affect several QNAP operating system versions.

CVSS 3.1HIGH 8.7 Network No auth No interaction EPSS 0.39663 Published 2024-04-26 Fixed in 5.1.4.2596 build 20231128, 4.5.4.2627 build 20231225 +3 CWE-22
TI-2023-28023 CVE-2023-51365 · GHSA-p7j9-7qwr-c4hr

Path traversal in QNAP QTS

Priority MEDIUM 63

A path traversal vulnerability has been reported to affect several QNAP operating system versions.

CVSS 3.1HIGH 8.7 Network No auth No interaction EPSS 0.34818 Published 2024-04-26 Fixed in 5.1.4.2596 build 20231128, 4.5.4.2627 build 20231225 +3 CWE-22
TI-2023-24080 CVE-2023-45026 · GHSA-vg4f-g292-cmwp

Path traversal in QNAP QTS

Priority MEDIUM 58

A path traversal vulnerability has been reported to affect several QNAP operating system versions.

CVSS 3.1MEDIUM 5.5 Network High privileges No interaction EPSS 0.00454 Published 2024-02-02 Fixed in 5.1.5.2645 build 20240116, h5.1.5.2647 build 20240118 +1 CWE-22
TI-2023-09215 CVE-2023-23369 · GHSA-5p75-fm4f-6c3v

Command injection in QNAP Multimedia Console

Priority MEDIUM 58

An OS command injection vulnerability has been reported to affect several QNAP operating system versions.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.1415 Published 2023-11-03 Fixed in 2.1.2 ( 2023/05/04 ), 1.4.8 ( 2023/05/05 ) +7 CWE-77
TI-2022-10583 CVE-2022-27596 · GHSA-xj35-32mv-jpmp

Vulnerability in QTS

Priority MEDIUM 54

A vulnerability has been reported to affect QNAP device running QuTS hero, QTS.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.02663 Published 2023-01-30 Fixed in h5.0.1.2248 build 20221215, 5.0.1.2234 build 20221201 CWE-89
TI-2024-21640 CVE-2024-32766 · GHSA-j64h-79xv-rx9g

Command injection in QNAP QTS

Priority MEDIUM 53

An OS command injection vulnerability has been reported to affect several QNAP operating system versions.

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.02315 Published 2024-04-26 Fixed in 5.1.3.2578 build 20231110, 4.5.4.2627 build 20231225 +3 CWE-77
TI-2025-40755 CVE-2025-66277 · GHSA-3wh2-2wc5-f45w

Link following in QNAP QTS

Priority MEDIUM 49

A link following vulnerability has been reported to affect several QNAP operating system versions.

CVSS 4.0CRITICAL 9.2 Network No auth No interaction EPSS 0.00702 Published 2026-02-11 Fixed in 5.2.8.3350 build 20251216, h5.3.2.3354 build 20251225 +1 CWE-59
TI-2017-12508 CVE-2017-17033 · GHSA-pmhm-4qjx-4cwf

Memory corruption in QNAP QTS Notification function

Priority MEDIUM 49

A buffer overflow vulnerability in password function in QNAP QTS version 4.2.6 build 20171026, 4.3.3.0378 build 20171117, 4.3.4.0387 (Beta 2) build 20171116 and earlier could allow remote attackers to execute arbitrary c…

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.04439 Published 2017-12-21 No fix listed CWE-119
Load more
Open these records in search →