Cross-site request forgery in QNAP Notification Center
Priority LOW 22CWE-352Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Active
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Tampering
- Confidentiality · integrity · availability
- None · Low · None
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-352.
Summary
A cross-site request forgery (CSRF) vulnerability has been reported to affect Notification Center. The remote attackers can then exploit the vulnerability to gain privileges or hijack user identities. We have already fixed the vulnerability in the following version: Notification Center 1.10.0.3291 and later
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00156 4th percentileScored 2026-11-07
Fix Fixed Notification Center (QNAP Systems Inc.): 1.10.0.3291
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
Remediation
- Fix · CNA Notification Center (QNAP Systems Inc.) Fixed in 1.10.0.3291
Timeline
- 2026-10-02 Threatist record created from CVE-2025-58468
- 2026-10-03 Alias added: GHSA-g758-jg83-j6jj
References
Sources
- CVE-2025-58468 · CVE Program
- CVE-2025-58468 · NVD
- FIRST EPSS
- GHSA-g758-jg83-j6jj · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences