Read the docs
TI-2020-18515 Aliases CVE-2020-36195GHSA-w8v9-r423-9xg2

SQL Injection Vulnerability in Multimedia Console and the Media Streaming Add-On

Priority MEDIUM 46CWE-20Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
SQL injection
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-89.

Summary

An SQL injection vulnerability has been reported to affect QNAP NAS running Multimedia Console or the Media Streaming add-on. If exploited, the vulnerability allows remote attackers to obtain application information. QNAP has already fixed this vulnerability in the following versions of Multimedia Console and the Media Streaming add-on. QTS 4.3.3: Media Streaming add-on 430.1.8.10 and later QTS 4.3.6: Media Streaming add-on 430.1.8.8 and later QTS 4.4.x and later: Multimedia Console 1.3.4 and later We have also fixed this vulnerability in the following versions of QTS 4.3.3 and QTS 4.3.6, respectively: QTS 4.3.3.1624 Build 20210416 or later QTS 4.3.6.1620 Build 20210322 or later

Why it matters now

EPSS 0.01828 78th percentileScored 2026-11-07
Fix Fixed QTS (QNAP Systems Inc.): 4.3.3.1624 Build 20210416, 4.3.6.1620 Build 20210322Media Streaming add-on (QNAP Systems Inc.): 430.1.8.10, 430.1.8.8+1 more product

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
QNAPQTSbefore 4.3.3.1624 Build 20210416; before 4.3.6.1620 Build 202103224.3.3.1624 Build 20210416, 4.3.6.1620 Build 20210322Patch availableCNA
QNAPMedia Streaming add-onbefore 430.1.8.10; before 430.1.8.8430.1.8.10, 430.1.8.8Patch availableCNA
QNAPMultimedia Consolebefore 1.3.41.3.4Patch availableCNA
  • QTS VendorQNAP Affected before 4.3.3.1624 Build 20210416; before 4.3.6.1620 Build 20210322 Fixed in 4.3.3.1624 Build 20210416, 4.3.6.1620 Build 20210322 Patch available CNA
  • Media Streaming add-on VendorQNAP Affected before 430.1.8.10; before 430.1.8.8 Fixed in 430.1.8.10, 430.1.8.8 Patch available CNA
  • Multimedia Console VendorQNAP Affected before 1.3.4 Fixed in 1.3.4 Patch available CNA

CPE configurations NVD · 59

CPEVersionsRoleVendor
cpe:2.3:o:qnap:qts:*:*:*:*:*:*:*:*before 4.3.3; 4.3.4 to before 4.3.6VulnerableQNAP
cpe:2.3:o:qnap:qts:4.3.3:*:*:*:*:*:*:*4.3.3VulnerableQNAP
cpe:2.3:o:qnap:qts:4.3.3.0095:*:*:*:*:*:*:*4.3.3.0095VulnerableQNAP
cpe:2.3:o:qnap:qts:4.3.3.0096:*:*:*:*:*:*:*4.3.3.0096VulnerableQNAP
cpe:2.3:o:qnap:qts:4.3.3.0136:*:*:*:*:*:*:*4.3.3.0136VulnerableQNAP
cpe:2.3:o:qnap:qts:4.3.3.0154:*:*:*:*:*:*:*4.3.3.0154VulnerableQNAP
cpe:2.3:o:qnap:qts:4.3.3.0174:*:*:*:*:*:*:*4.3.3.0174VulnerableQNAP
cpe:2.3:o:qnap:qts:4.3.3.0188:*:*:*:*:*:*:*4.3.3.0188VulnerableQNAP
cpe:2.3:o:qnap:qts:4.3.3.0210:*:*:*:*:*:*:*4.3.3.0210VulnerableQNAP
cpe:2.3:o:qnap:qts:4.3.3.0229:*:*:*:*:*:*:*4.3.3.0229VulnerableQNAP
  • cpe:2.3:o:qnap:qts:*:*:*:*:*:*:*:* Versions before 4.3.3; 4.3.4 to before 4.3.6 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.3:*:*:*:*:*:*:* Versions 4.3.3 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.3.0095:*:*:*:*:*:*:* Versions 4.3.3.0095 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.3.0096:*:*:*:*:*:*:* Versions 4.3.3.0096 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.3.0136:*:*:*:*:*:*:* Versions 4.3.3.0136 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.3.0154:*:*:*:*:*:*:* Versions 4.3.3.0154 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.3.0174:*:*:*:*:*:*:* Versions 4.3.3.0174 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.3.0188:*:*:*:*:*:*:* Versions 4.3.3.0188 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.3.0210:*:*:*:*:*:*:* Versions 4.3.3.0210 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.3.0229:*:*:*:*:*:*:* Versions 4.3.3.0229 Vulnerable ·QNAP
Show 49 more CPE
CPEVersionsRoleVendor
cpe:2.3:o:qnap:qts:4.3.3.0238:*:*:*:*:*:*:*4.3.3.0238VulnerableQNAP
cpe:2.3:o:qnap:qts:4.3.3.0262:*:*:*:*:*:*:*4.3.3.0262VulnerableQNAP
cpe:2.3:o:qnap:qts:4.3.3.0299:*:*:*:*:*:*:*4.3.3.0299VulnerableQNAP
cpe:2.3:o:qnap:qts:4.3.3.0351:*:*:*:*:*:*:*4.3.3.0351VulnerableQNAP
cpe:2.3:o:qnap:qts:4.3.3.0353:*:*:*:*:*:*:*4.3.3.0353VulnerableQNAP
cpe:2.3:o:qnap:qts:4.3.3.0361:*:*:*:*:*:*:*4.3.3.0361VulnerableQNAP
cpe:2.3:o:qnap:qts:4.3.3.0369:*:*:*:*:*:*:*4.3.3.0369VulnerableQNAP
cpe:2.3:o:qnap:qts:4.3.3.0378:*:*:*:*:*:*:*4.3.3.0378VulnerableQNAP
cpe:2.3:o:qnap:qts:4.3.3.0396:*:*:*:*:*:*:*4.3.3.0396VulnerableQNAP
cpe:2.3:o:qnap:qts:4.3.3.0404:*:*:*:*:*:*:*4.3.3.0404VulnerableQNAP
cpe:2.3:o:qnap:qts:4.3.3.0416:*:*:*:*:*:*:*4.3.3.0416VulnerableQNAP
cpe:2.3:o:qnap:qts:4.3.3.0418:*:*:*:*:*:*:*4.3.3.0418VulnerableQNAP
cpe:2.3:o:qnap:qts:4.3.3.0448:*:*:*:*:*:*:*4.3.3.0448VulnerableQNAP
cpe:2.3:o:qnap:qts:4.3.3.0514:*:*:*:*:*:*:*4.3.3.0514VulnerableQNAP
cpe:2.3:o:qnap:qts:4.3.3.0546:*:*:*:*:*:*:*4.3.3.0546VulnerableQNAP
cpe:2.3:o:qnap:qts:4.3.3.0570:*:*:*:*:*:*:*4.3.3.0570VulnerableQNAP
cpe:2.3:o:qnap:qts:4.3.3.0868:*:*:*:*:*:*:*4.3.3.0868VulnerableQNAP
cpe:2.3:o:qnap:qts:4.3.3.0998:*:*:*:*:*:*:*4.3.3.0998VulnerableQNAP
cpe:2.3:o:qnap:qts:4.3.3.1051:*:*:*:*:*:*:*4.3.3.1051VulnerableQNAP
cpe:2.3:o:qnap:qts:4.3.3.1098:*:*:*:*:*:*:*4.3.3.1098VulnerableQNAP
cpe:2.3:o:qnap:qts:4.3.3.1161:*:*:*:*:*:*:*4.3.3.1161VulnerableQNAP
cpe:2.3:o:qnap:qts:4.3.3.1252:*:*:*:*:*:*:*4.3.3.1252VulnerableQNAP
cpe:2.3:o:qnap:qts:4.3.3.1315:*:*:*:*:*:*:*4.3.3.1315VulnerableQNAP
cpe:2.3:o:qnap:qts:4.3.3.1386:*:*:*:*:*:*:*4.3.3.1386VulnerableQNAP
cpe:2.3:o:qnap:qts:4.3.3.1432:*:*:*:*:*:*:*4.3.3.1432VulnerableQNAP
cpe:2.3:o:qnap:qts:4.3.6:-:*:*:*:*:*:*4.3.6VulnerableQNAP
cpe:2.3:o:qnap:qts:4.3.6.0895:*:*:*:*:*:*:*4.3.6.0895VulnerableQNAP
cpe:2.3:o:qnap:qts:4.3.6.0907:*:*:*:*:*:*:*4.3.6.0907VulnerableQNAP
cpe:2.3:o:qnap:qts:4.3.6.0923:*:*:*:*:*:*:*4.3.6.0923VulnerableQNAP
cpe:2.3:o:qnap:qts:4.3.6.0944:*:*:*:*:*:*:*4.3.6.0944VulnerableQNAP
cpe:2.3:o:qnap:qts:4.3.6.0959:*:*:*:*:*:*:*4.3.6.0959VulnerableQNAP
cpe:2.3:o:qnap:qts:4.3.6.0979:*:*:*:*:*:*:*4.3.6.0979VulnerableQNAP
cpe:2.3:o:qnap:qts:4.3.6.0993:*:*:*:*:*:*:*4.3.6.0993VulnerableQNAP
cpe:2.3:o:qnap:qts:4.3.6.1013:*:*:*:*:*:*:*4.3.6.1013VulnerableQNAP
cpe:2.3:o:qnap:qts:4.3.6.1033:*:*:*:*:*:*:*4.3.6.1033VulnerableQNAP
cpe:2.3:o:qnap:qts:4.3.6.1070:*:*:*:*:*:*:*4.3.6.1070VulnerableQNAP
cpe:2.3:o:qnap:qts:4.3.6.1154:*:*:*:*:*:*:*4.3.6.1154VulnerableQNAP
cpe:2.3:o:qnap:qts:4.3.6.1218:*:*:*:*:*:*:*4.3.6.1218VulnerableQNAP
cpe:2.3:o:qnap:qts:4.3.6.1263:*:*:*:*:*:*:*4.3.6.1263VulnerableQNAP
cpe:2.3:o:qnap:qts:4.3.6.1286:*:*:*:*:*:*:*4.3.6.1286VulnerableQNAP
cpe:2.3:o:qnap:qts:4.3.6.1333:*:*:*:*:*:*:*4.3.6.1333VulnerableQNAP
cpe:2.3:o:qnap:qts:4.3.6.1411:*:*:*:*:*:*:*4.3.6.1411VulnerableQNAP
cpe:2.3:o:qnap:qts:4.3.6.1446:*:*:*:*:*:*:*4.3.6.1446VulnerableQNAP
cpe:2.3:a:qnap:media_streaming_add-on:*:*:*:*:*:*:*:*before 430.1.8.10VulnerableQNAP
cpe:2.3:o:qnap:qts:4.3.3:*:*:*:*:*:*:*4.3.3Running onQNAP
cpe:2.3:a:qnap:media_streaming_add-on:*:*:*:*:*:*:*:*before 430.1.8.8VulnerableQNAP
cpe:2.3:o:qnap:qts:4.3.6:*:*:*:*:*:*:*4.3.6Running onQNAP
cpe:2.3:a:qnap:multimedia_console:*:*:*:*:*:*:*:*before 1.3.4VulnerableQNAP
cpe:2.3:o:qnap:qts:*:*:*:*:*:*:*:*4.4.0Running onQNAP
  • cpe:2.3:o:qnap:qts:4.3.3.0238:*:*:*:*:*:*:* Versions 4.3.3.0238 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.3.0262:*:*:*:*:*:*:* Versions 4.3.3.0262 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.3.0299:*:*:*:*:*:*:* Versions 4.3.3.0299 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.3.0351:*:*:*:*:*:*:* Versions 4.3.3.0351 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.3.0353:*:*:*:*:*:*:* Versions 4.3.3.0353 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.3.0361:*:*:*:*:*:*:* Versions 4.3.3.0361 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.3.0369:*:*:*:*:*:*:* Versions 4.3.3.0369 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.3.0378:*:*:*:*:*:*:* Versions 4.3.3.0378 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.3.0396:*:*:*:*:*:*:* Versions 4.3.3.0396 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.3.0404:*:*:*:*:*:*:* Versions 4.3.3.0404 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.3.0416:*:*:*:*:*:*:* Versions 4.3.3.0416 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.3.0418:*:*:*:*:*:*:* Versions 4.3.3.0418 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.3.0448:*:*:*:*:*:*:* Versions 4.3.3.0448 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.3.0514:*:*:*:*:*:*:* Versions 4.3.3.0514 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.3.0546:*:*:*:*:*:*:* Versions 4.3.3.0546 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.3.0570:*:*:*:*:*:*:* Versions 4.3.3.0570 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.3.0868:*:*:*:*:*:*:* Versions 4.3.3.0868 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.3.0998:*:*:*:*:*:*:* Versions 4.3.3.0998 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.3.1051:*:*:*:*:*:*:* Versions 4.3.3.1051 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.3.1098:*:*:*:*:*:*:* Versions 4.3.3.1098 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.3.1161:*:*:*:*:*:*:* Versions 4.3.3.1161 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.3.1252:*:*:*:*:*:*:* Versions 4.3.3.1252 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.3.1315:*:*:*:*:*:*:* Versions 4.3.3.1315 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.3.1386:*:*:*:*:*:*:* Versions 4.3.3.1386 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.3.1432:*:*:*:*:*:*:* Versions 4.3.3.1432 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.6:-:*:*:*:*:*:* Versions 4.3.6 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.6.0895:*:*:*:*:*:*:* Versions 4.3.6.0895 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.6.0907:*:*:*:*:*:*:* Versions 4.3.6.0907 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.6.0923:*:*:*:*:*:*:* Versions 4.3.6.0923 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.6.0944:*:*:*:*:*:*:* Versions 4.3.6.0944 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.6.0959:*:*:*:*:*:*:* Versions 4.3.6.0959 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.6.0979:*:*:*:*:*:*:* Versions 4.3.6.0979 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.6.0993:*:*:*:*:*:*:* Versions 4.3.6.0993 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.6.1013:*:*:*:*:*:*:* Versions 4.3.6.1013 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.6.1033:*:*:*:*:*:*:* Versions 4.3.6.1033 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.6.1070:*:*:*:*:*:*:* Versions 4.3.6.1070 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.6.1154:*:*:*:*:*:*:* Versions 4.3.6.1154 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.6.1218:*:*:*:*:*:*:* Versions 4.3.6.1218 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.6.1263:*:*:*:*:*:*:* Versions 4.3.6.1263 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.6.1286:*:*:*:*:*:*:* Versions 4.3.6.1286 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.6.1333:*:*:*:*:*:*:* Versions 4.3.6.1333 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.6.1411:*:*:*:*:*:*:* Versions 4.3.6.1411 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.6.1446:*:*:*:*:*:*:* Versions 4.3.6.1446 Vulnerable ·QNAP
  • cpe:2.3:a:qnap:media_streaming_add-on:*:*:*:*:*:*:*:* Versions before 430.1.8.10 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.3:*:*:*:*:*:*:* Versions 4.3.3 Running on ·QNAP
  • cpe:2.3:a:qnap:media_streaming_add-on:*:*:*:*:*:*:*:* Versions before 430.1.8.8 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.6:*:*:*:*:*:*:* Versions 4.3.6 Running on ·QNAP
  • cpe:2.3:a:qnap:multimedia_console:*:*:*:*:*:*:*:* Versions before 1.3.4 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:*:*:*:*:*:*:*:* Versions 4.4.0 Running on ·QNAP

Remediation

  • Fix · CNA QTS (QNAP Systems Inc.) Fixed in 4.3.3.1624 Build 20210416, 4.3.6.1620 Build 20210322
  • Fix · CNA Media Streaming add-on (QNAP Systems Inc.) Fixed in 430.1.8.10, 430.1.8.8
  • Fix · CNA Multimedia Console (QNAP Systems Inc.) Fixed in 1.3.4

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-36195
  2. 2026-10-03 Alias added: GHSA-w8v9-r423-9xg2

References

Advisory 1

  • TI-2023-09215 Command injection in QNAP Multimedia Console CVSS 3.1CRITICAL 9.8
  • TI-2017-05276 OS command injection in QNAP Media Streaming Add-On CVSS 3.0CRITICAL 9.8
  • TI-2023-25540 Information disclosure in QNAP Media Streaming add-on CVSS 3.1CRITICAL 9.8
  • TI-2021-13401 Command Injection Vulnerability in Media Streaming Add-on CVSS 3.1HIGH 8.7
  • TI-2017-05277 QNAP NAS application Media Streaming add-on version 421.1.0.2, 430.1.2.0, and earlier does not utilize CSRF protections. CVSS 3.0HIGH 8.8
  • TI-2024-33828 Authorization bypass in QNAP Media Streaming add-on CVSS 4.0MEDIUM 6.9
See all 12 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences