Read the docs

QNAP

Records682All Threatist records
Exploited (KEV)14In CISA KEV
CVSS critical101CVSS 9.0–10.0
CVSS high234CVSS 7.0–8.9

Exploited now

QNAP records in CISA KEV
TI-2023-25733 QNAP VioStor NVR OS Command Injection Vulnerability Priority CRITICAL 97KEV 2023-12-21TI-2022-10581 QNAP Photo Station Externally Controlled Reference Vulnerability Priority CRITICAL 100KEV 2022-09-08TI-2019-05100 QNAP Photo Station Improper Access Control Vulnerability Priority CRITICAL 100KEV 2022-06-08TI-2019-05101 QNAP QTS Improper Input Validation Vulnerability Priority CRITICAL 100KEV 2022-06-08TI-2019-05102 QNAP Photo Station Path Traversal Vulnerability Priority CRITICAL 100KEV 2022-06-08TI-2019-05103 QNAP Photo Station Path Traversal Vulnerability Priority CRITICAL 100KEV 2022-06-08

Components

Products in the NVD configurations · select one to filter the records
Qts 283 records CRITICAL Quts Hero 234 records CRITICAL Qsync Central 62 records MEDIUM Qutscloud 62 records HIGH File Station 57 records LOW Photo Station 26 records CRITICAL Video Station 21 records MEDIUM Media Streaming Add-on 13 records MEDIUM

Records

12 records in Qurouter · all components

TI-2024-32560 CVE-2024-48860 · GHSA-8qxc-g23q-chq5

Command injection in QNAP QuRouter

Priority MEDIUM 52

An OS command injection vulnerability has been reported to affect several product versions.

CVSS 4.0CRITICAL 9.5 Network No auth No interaction EPSS 0.01463 Published 2024-11-22 Fixed in 2.4.3.103 CWE-77
TI-2024-33824 CVE-2024-50389 · GHSA-5p7p-gj53-x6pp

SQL injection in QNAP QuRouter

Priority MEDIUM 44

A SQL injection vulnerability has been reported to affect QuRouter.

CVSS 4.0CRITICAL 9.5 Network No auth No interaction EPSS 0.00827 Published 2024-12-06 Fixed in 2.4.5.032 CWE-89
TI-2024-33825 CVE-2024-50390 · GHSA-vj79-3hwh-jcf7

OS command injection in QNAP QuRouter

Priority LOW 38

A command injection vulnerability has been reported to affect QHora.

CVSS 4.0HIGH 7.7 Network No auth User interaction EPSS 0.01051 Published 2025-03-07 Fixed in 2.4.5.032 CWE-1188
TI-2025-21275 CVE-2025-29887 · GHSA-423r-mv6p-g8cm

QuRouter 2.5

Priority LOW 35

A command injection vulnerability has been reported to affect QuRouter 2.5.1.

CVSS 4.0HIGH 7.1 Network High privileges User interaction EPSS 0.00839 Published 2025-08-29 Fixed in 2.5.1.060 CWE-77
TI-2024-32561 CVE-2024-48861 · GHSA-m5jm-j4cj-7522

Command injection in QNAP QuRouter

Priority LOW 35

An OS command injection vulnerability has been reported to affect several product versions.

CVSS 4.0HIGH 7.3 Physical No auth No interaction EPSS 0.0076 Published 2024-11-22 Fixed in 2.4.4.106 CWE-77
TI-2025-38999 CVE-2025-62846 · GHSA-gfqf-8rx6-9xqw

SQL injection in QNAP QuRouter

Priority LOW 33

An SQL injection vulnerability has been reported to affect QHora.

CVSS 4.0HIGH 7.3 Local High privileges No interaction EPSS 0.00212 Published 2026-03-20 Fixed in 2.6.2.007 CWE-89
TI-2024-35898 CVE-2024-53700 · GHSA-gv88-vwqw-9qgj

Command injection in QNAP QuRouter

Priority LOW 26

A command injection vulnerability has been reported to affect QHora.

CVSS 4.0MEDIUM 5.1 Network High privileges No interaction EPSS 0.01225 Published 2025-03-07 Fixed in 2.4.6.028 CWE-77
TI-2024-12136 CVE-2024-13088 · GHSA-8m5f-fx5r-2p23

Improper authentication in QNAP QuRouter

Priority LOW 23

An improper authentication vulnerability has been reported to affect QHora.

CVSS 4.0MEDIUM 5.2 Physical No auth User interaction EPSS 0.00276 Published 2025-06-06 Fixed in 2.5.0.140 CWE-287
TI-2025-38997 CVE-2025-62844 · GHSA-5gfx-m376-wpjr

Weak authentication in QNAP QuRouter

Priority LOW 20

A weak authentication vulnerability has been reported to affect QHora.

CVSS 4.0MEDIUM 4.0 Physical No auth No interaction EPSS 0.0021 Published 2026-03-20 Fixed in 2.6.2.007 CWE-1390
TI-2024-12135 CVE-2024-13087 · GHSA-7c8j-xg5r-5j56

OS command injection in QNAP QuRouter

Priority LOW 13

A command injection vulnerability has been reported to affect QHora.

CVSS 4.0LOW 2.4 Physical High privileges No interaction EPSS 0.00656 Published 2025-06-06 Fixed in 2.4.6.028 CWE-78
Open these records in search →