CVE-2026-26236 is a missing authorization vulnerability in QNAP Systems Inc.'s QuMagie product. This flaw allows remote attackers to access unauthorized data or perform unauthorized actions without proper permissions. The vulnerability has been fixed in QuMagie version 2.9.0 and later. The CVSS 4.0 base score is 6.6, indicating a medium severity level.
A buffer overflow vulnerability has been reported to affect Media Streaming Add-On. The remote attackers can then exploit the vulnerability to modify memory or crash processes.
We have already fixed the vulnerability in the following version:
Media Streaming Add-on 500.1.1 and later
CVE-2025-62843 is a vulnerability in QNAP Systems Inc. QuRouter affecting version 2.6.x. It involves improper restriction of communication channels to intended endpoints, which could allow an attacker with physical access to gain privileges intended for the original endpoint. The vulnerability has been fixed in QuRouter version 2.6.3.009 and later. The CVSS 4.
CVE-2025-62844 is a medium severity vulnerability in QNAP Systems Inc. QuRouter affecting version 2.6.x. It involves weak authentication that could allow an attacker with local network access to gain sensitive information. The vulnerability has been fixed in QuRouter version 2.6.2.007 and later. There are no known exploits in the wild at this time.
CVE-2025-62845 is a medium severity vulnerability in QNAP Systems Inc. QuRouter versions 2.6.x. It involves improper neutralization of escape, meta, or control sequences (CWE-150). A local attacker with administrator privileges can exploit this flaw to cause unexpected behavior. The vulnerability has been fixed in QuRouter version 2.6.3.009 and later.
CVE-2025-62846 is an SQL injection vulnerability affecting QNAP Systems Inc. QuRouter versions 2.6.x. A local attacker with administrator privileges can exploit this vulnerability to execute unauthorized code or commands. The vulnerability has been fixed in QuRouter version 2.6.2.007 and later. The CVSS 4.
A cross-site scripting (XSS) vulnerability has been reported to affect QuFTP Service. If a remote attacker gains an administrator account, they can then exploit the vulnerability to bypass security mechanisms or read application data.
We have already fixed the vulnerability in the following versions:
QuFTP Service 1.4.3 and later
QuFTP Service 1.5.2 and later
QuFTP Service 1.6.2 and later
A command injection vulnerability has been reported to affect QuNetSwitch. The remote attackers can then exploit the vulnerability to execute arbitrary commands.
We have already fixed the vulnerability in the following version:
QuNetSwitch 2.0.4.0415 and later
CVE-2026-22898 is a critical vulnerability in QNAP Systems Inc. 's QVR Pro product, specifically affecting version 2.7.x. It is caused by missing authentication for a critical function, allowing remote attackers to gain unauthorized access to the system. This vulnerability has been fixed in QVR Pro version 2.7.4.14 and later. The CVSS 4.
A use of hard-coded credentials vulnerability has been reported to affect QuNetSwitch. The remote attackers can then exploit the vulnerability to gain unauthorized access.
We have already fixed the vulnerability in the following version:
QuNetSwitch 2.0.5.0906 and later
A command injection vulnerability has been reported to affect QuNetSwitch. If a remote attacker gains a user account, they can then exploit the vulnerability to execute arbitrary commands.
We have already fixed the vulnerability in the following version:
QuNetSwitch 2.0.5.0906 and later
A command injection vulnerability has been reported to affect QuNetSwitch. If a local attacker gains an administrator account, they can then exploit the vulnerability to execute arbitrary commands.
We have already fixed the vulnerability in the following version:
QuNetSwitch 2.0.5.0906 and later
CVE-2025-59388 is a medium-severity vulnerability in QNAP Systems Inc. 's Hyper Data Protector version 2.3.x. It is caused by the use of a hard-coded password (CWE-259), which allows remote attackers to gain unauthorized access without any authentication or user interaction. The vulnerability has been fixed in version 2.3.1.455 and later. Exploitation requires no privileges and no user interaction, making it relatively easy to exploit remotely.
A command injection vulnerability has been reported to affect several QNAP operating system versions. If an attacker gains local network access who have also gained a user account, they can then exploit the vulnerability to execute arbitrary commands.
We have already fixed the vulnerability in the following versions:
QTS 5.1.9.2954 build 20241120 and later
QTS 5.2.3.3006 build 20250108 and later
QuTS hero h5.1.9.2954 build 20241120 and later
QuTS hero h5.2.3.3006 build 20250108 and later
An SQL injection vulnerability has been reported to affect Video Station. If an attacker gains local network access who have also gained an administrator account, they can then exploit the vulnerability to execute unauthorized code or commands.
We have already fixed the vulnerability in the following version:
Video Station 5.8.2 and later
An improper certificate validation vulnerability has been reported to affect Video Station. If an attacker gains local network access who have also gained an administrator account, they can then exploit the vulnerability to compromise the security of the system.
We have already fixed the vulnerability in the following version:
Video Station 5.8.2 and later
CVE-2024-56807 is an out-of-bounds read vulnerability (CWE-125) affecting QNAP Systems Inc. 's Media Streaming add-on version 500.1.x. An attacker with local network access can exploit this flaw to read secret data from the device's memory. The vulnerability does not require authentication or user interaction and has a low CVSS 4.0 score of 1.7, indicating limited impact and difficulty of exploitation. QNAP has released a fixed version 500.1.
CVE-2024-56808 is a command injection vulnerability in QNAP Systems Inc. 's Media Streaming add-on, affecting versions 500.1.x prior to 500.1.1.6. An attacker with local network access and a valid user account can exploit this flaw to execute arbitrary commands on the affected device. The vulnerability requires low privileges but no user interaction, and it does not affect systems remotely without authentication. The vendor has released a patch in version 500.
CVE-2025-30266 is a NULL pointer dereference vulnerability in QNAP Systems Inc. 's Qsync Central version 5.0.x.x. A remote attacker with a valid user account can exploit this flaw to cause a denial-of-service (DoS) condition, crashing or disrupting the service. The vulnerability does not require user interaction but does require authenticated access, limiting the attack surface. The issue has been fixed in Qsync Central version 5.0.0.
CVE-2025-30269 is a use of externally-controlled format string vulnerability in QNAP Systems Inc. 's Qsync Central product. A remote attacker with a valid user account can exploit this flaw to read secret data or modify memory, potentially leading to unauthorized information disclosure or application instability. The vulnerability affects Qsync Central versions 5.0.x.x prior to 5.0.0.4, which was patched in January 2026.
