Read the docs
TI-2020-02206 Aliases CVE-2020-2494GHSA-jx9p-jf7x-8rr2

Cross-site Scripting Vulnerability in Music Station

Priority LOW 29CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-79.

Summary

This cross-site scripting vulnerability in Music Station allows remote attackers to inject malicious code. QANP have already fixed this vulnerability in the following versions of Music Station. QuTS hero h4.5.1: Music Station 5.3.13 and later QTS 4.5.1: Music Station 5.3.12 and later QTS 4.4.3: Music Station 5.3.12 and later

Why it matters now

EPSS 0.00993 62nd percentileScored 2026-11-07
Fix Fixed Music Station (QNAP Systems Inc.): 5.3.13, 5.3.12

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
QNAPMusic Stationbefore 5.3.13; before 5.3.125.3.13, 5.3.12Patch availableCNA
  • Music Station VendorQNAP Affected before 5.3.13; before 5.3.12 Fixed in 5.3.13, 5.3.12 Patch available CNA

CPE configurations NVD · 5

CPEVersionsRoleVendor
cpe:2.3:a:qnap:music_station:*:*:*:*:*:*:*:*before 5.3.13VulnerableQNAP
cpe:2.3:o:qnap:quts_hero:h4.5.1:*:*:*:*:*:*:*h4.5.1Running onQNAP
cpe:2.3:a:qnap:music_station:*:*:*:*:*:*:*:*before 5.3.12VulnerableQNAP
cpe:2.3:o:qnap:qts:4.5.1:*:*:*:*:*:*:*4.5.1Running onQNAP
cpe:2.3:a:qnap:qts:4.4.3:*:*:*:*:*:*:*4.4.3Running onQNAP
  • cpe:2.3:a:qnap:music_station:*:*:*:*:*:*:*:* Versions before 5.3.13 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:quts_hero:h4.5.1:*:*:*:*:*:*:* Versions h4.5.1 Running on ·QNAP
  • cpe:2.3:a:qnap:music_station:*:*:*:*:*:*:*:* Versions before 5.3.12 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.5.1:*:*:*:*:*:*:* Versions 4.5.1 Running on ·QNAP
  • cpe:2.3:a:qnap:qts:4.4.3:*:*:*:*:*:*:* Versions 4.4.3 Running on ·QNAP

Remediation

  • Fix · CNA Music Station (QNAP Systems Inc.) Fixed in 5.3.13, 5.3.12

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-2494
  2. 2026-10-03 Alias added: GHSA-jx9p-jf7x-8rr2

References

Advisory 1

  • TI-2020-18517 Improper Access Control Vulnerability in Music Station CVSS 3.1HIGH 8.8
  • TI-2018-00678 Command injection in QNAP NAS devices CVSS 3.1CRITICAL 9.8
  • TI-2018-14138 Command injection in QNAP Music Station CVSS 3.1CRITICAL 9.8
  • TI-2018-00671 Command injection in QNAP Music Station CVSS 3.0CRITICAL 9.8
  • TI-2017-09711 QNAP discovered a number of command injection vulnerabilities found in Music Station… CVSS 3.0CRITICAL 9.8
  • TI-2023-24086 Improper authentication in QNAP Music Station CVSS 3.1HIGH 8.8
See all 12 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences