QNAP vulnerabilities
We track 252 vulnerabilities in QNAP products across 60+ products. 250 are rated high or critical, and 14 have been exploited in real attacks. The most recent was published on October 29, 2026.
Latest QNAP vulnerabilities
- 8.7 High severity
HBS 3 Hybrid Backup Sync: Use of Hard-coded Cryptographic Key
An use of hard-coded cryptographic key vulnerability has been reported to affect HBS 3 Hybrid Backup Sync and Hybrid Backup Sync. If exploited, the vulnerability could allow remote attackers to compromise the security of the system. We have already fixed the v
- 8.7 High severity
HBS 3 Hybrid Backup Sync: Use of Hard-coded Cryptographic Key
An use of hard-coded cryptographic key vulnerability has been reported to affect HBS 3 Hybrid Backup Sync and Hybrid Backup Sync. If exploited, the vulnerability could allow remote attackers to compromise the security of the system. We have already fixed the v
- 8.7 High severity
Virtualization Station: Improper Link Resolution Before File Access
An improper link resolution before file access ('link following') vulnerability has been reported to affect Virtualization Station. If a remote attacker gains a user account, they can then exploit the vulnerability to compromise the security of the system. We
- 9.3 Critical severity
Qsirch: Improper Limitation of a Pathname to a Restricted Directory
A path traversal vulnerability has been reported to affect Qsirch. If exploited, the vulnerability could allow remote attackers to read the contents of unexpected files or system data. We have already fixed the vulnerability in the following version: Qsirch 7.
- 9.4 Critical severity
QuMagie: UNIX Symbolic Link (Symlink) Following
An unix symbolic link (symlink) following vulnerability has been reported to affect QuMagie. If a remote attacker gains a user account, they can then exploit the vulnerability to compromise the security of the system. We have already fixed the vulnerability in
- 9.3 Critical severity
HybridDesk Station: Improper Neutralization of Special Elements used in an OS Command
An OS command injection vulnerability has been reported to affect HybridDesk Station. If exploited, the vulnerability could allow remote attackers to execute arbitrary commands. We have already fixed the vulnerability in the following version: HybridDesk Stati
- 7.5 High severity
Video Station: Authorization Bypass Through User-Controlled Key
An authorization bypass through user-controlled key vulnerability has been reported to affect Video Station. If exploited, the vulnerability could allow remote attackers to obtain sensitive data. We have already fixed the vulnerability in the following version
- 8.6 High severity
QuMagie: Relative Path Traversal
A relative path traversal vulnerability has been reported to affect QuMagie. If a remote attacker gains an administrator account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed the vulnera
- 8.9 High severity
HybridDesk Station: Missing Authentication for Critical Functionality
A missing authentication for critical function vulnerability has been reported to affect HybridDesk Station. If exploited, the vulnerability could allow remote attackers to gain access to the system. We have already fixed the vulnerability in the following ver
- 8.4 High severity
Download Station: Incorrect Permission Assignment for Critical Resource
An incorrect permission assignment for critical resource vulnerability has been reported to affect Download Station. If a local attacker gains an administrator account, they can then exploit the vulnerability to compromise the security of the system. We have a
- 8.4 High severity
Notes Station 3: Improper Isolation or Compartmentalization
An improper isolation or compartmentalization vulnerability has been reported to affect Notes Station 3. If a local attacker gains an administrator account, they can then exploit the vulnerability to compromise the security of the system. We have already fixed
- 8.5 High severity
Notes Station 3: Incorrect Permission Assignment for Critical Resource
An incorrect permission assignment for critical resource vulnerability has been reported to affect Notes Station 3. If a local attacker gains a user account, they can then exploit the vulnerability to compromise the security of the system. We have already fixe
- 9.3 Critical severity
sMedio DTCP MOVE: Missing Authentication for Critical Functionality
A missing authentication for critical function vulnerability has been reported to affect sMedio DTCP MOVE. If exploited, the vulnerability could allow remote attackers to gain access to the system. We have already fixed the vulnerability in the following versi
- 8.8 High severity
Video Station: Improper Neutralization of Special Elements used in an SQL Command
A SQL injection vulnerability has been reported to affect Video Station. If a remote attacker gains a user account, they can then exploit the vulnerability to execute unauthorized code or commands. We have already fixed the vulnerability in the following versi
- 8.8 High severity
Video Station: Improper Neutralization of Special Elements used in an SQL Command
A SQL injection vulnerability has been reported to affect Video Station. If a remote attacker gains a user account, they can then exploit the vulnerability to execute unauthorized code or commands. We have already fixed the vulnerability in the following versi
- 7.2 High severity
Qsync Central: Improper Limitation of a Pathname to a Restricted Directory
A path traversal vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed the vulnerability in the
- 8.7 High severity
QcalAgent: Improper Limitation of a Pathname to a Restricted Directory
A path traversal vulnerability has been reported to affect QcalAgent. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed the vulnerability in the fol
- 8.7 High severity
Download Station: Relative Path Traversal
A relative path traversal vulnerability has been reported to affect Download Station. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed the vulnerab
- 7.5 High severity
QuRouter: Time-of-check Time-of-use (TOCTOU) Race Condition
A time-of-check time-of-use (toctou) race condition vulnerability has been reported to affect QuRouter. If exploited, the vulnerability could allow remote attackers to compromise the security of the system. We have already fixed the vulnerability in the follow
- 9.1 Critical severity
File Station 5: Stack-based Buffer Overflow
A buffer overflow vulnerability has been reported to affect File Station 5. The remote attackers can then exploit the vulnerability to modify memory or crash processes. We have already fixed the vulnerability in the following version: File Station 5 5.5.6.5243
- 9.1 Critical severity
File Station 5: Stack-based Buffer Overflow
A buffer overflow vulnerability has been reported to affect File Station 5. The remote attackers can then exploit the vulnerability to modify memory or crash processes. We have already fixed the vulnerability in the following version: File Station 5 5.5.6.5243
- 8.1 High severity
File Station 5: Stack-based Buffer Overflow
A buffer overflow vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit the vulnerability to modify memory or crash processes. We have already fixed the vulnerability in the following version
- 7.5 High severity
QuMagie: Missing Authorization
A missing authorization vulnerability has been reported to affect QuMagie. The remote attackers can then exploit the vulnerability to access unauthorized data or perform unauthorized actions. We have already fixed the vulnerability in the following version: Qu
- 8.1 High severity
File Station 5: Incorrect Authorization
An incorrect authorization vulnerability has been reported to affect File Station 6. If a remote attacker gains a user account, they can then exploit the vulnerability to bypass intended access restrictions. We have already fixed the vulnerability in the follo
- 7.2 High severity
QTS: Improper Neutralization of Special Elements used in an OS Command
A command injection vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to execute arbitrary commands. We have already fixed the vulnerab
- 7.2 High severity
QTS: NULL Pointer Dereference
A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack. We have alread
- 7.2 High severity
QTS: Improper Neutralization of Special Elements used in an OS Command
A command injection vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to execute arbitrary commands. We have already fixed the vulnerab
- 7.2 High severity
QTS: NULL Pointer Dereference
A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. The remote attackers can then exploit the vulnerability to launch a denial-of-service (DoS) attack. We have already fixed the vulnerability in the foll
- 7.2 High severity
QTS: Stack-based Buffer Overflow
An integer overflow or wraparound vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to compromise the security of the system. We have a
- 7.2 High severity
QTS: Improper Neutralization of Special Elements used in an OS Command
A command injection vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to execute arbitrary commands. We have already fixed the vulnerab
- 7.2 High severity
QTS: Improper Neutralization of Special Elements used in an OS Command
A command injection vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to execute arbitrary commands. We have already fixed the vulnerab
- 7.2 High severity
QTS: NULL Pointer Dereference
A NULL pointer dereference vulnerability has been reported to affect QTS, QVP, QuTS cloud and QuTS hero. If a remote attacker gains an administrator account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack. We have already fi
- 8.8 High severity
Notification Center: Cross-Site Request Forgery
A cross-site request forgery (CSRF) vulnerability has been reported to affect Notification Center. The remote attackers can then exploit the vulnerability to gain privileges or hijack user identities. We have already fixed the vulnerability in the following ve
- 9.8 Critical severity
QuMagie: Authorization Bypass Through User-Controlled Key
An authorization bypass through user-controlled key vulnerability has been reported to affect QuMagie. The remote attackers can then exploit the vulnerability to gain unintended privileges. We have already fixed the vulnerability in the following version: QuMa
- 7.5 High severity
QuMagie: Missing Authorization
A missing authorization vulnerability has been reported to affect QuMagie. The remote attackers can then exploit the vulnerability to access unauthorized data or perform unauthorized actions. We have already fixed the vulnerability in the following version: Qu
- 9.8 Critical severity
QuNetSwitch: Improper Neutralization of Special Elements used in an OS Command
A command injection vulnerability has been reported to affect QuNetSwitch. If a remote attacker gains a user account, they can then exploit the vulnerability to execute arbitrary commands. We have already fixed the vulnerability in the following version: QuNet
- 9.8 Critical severity
QuNetSwitch: Use of Hard-coded Credentials
A use of hard-coded credentials vulnerability has been reported to affect QuNetSwitch. The remote attackers can then exploit the vulnerability to gain unauthorized access. We have already fixed the vulnerability in the following version: QuNetSwitch 2.0.5.0906
- 9.8 Critical severity
QVR Pro: Missing Authentication for Critical Functionality
A missing authentication for critical function vulnerability has been reported to affect QVR Pro. The remote attackers can then exploit the vulnerability to gain access to the system. We have already fixed the vulnerability in the following version: QVR Pro 2.
- 9.8 Critical severity
QuNetSwitch: Improper Neutralization of Special Elements used in an OS Command
A command injection vulnerability has been reported to affect QuNetSwitch. The remote attackers can then exploit the vulnerability to execute arbitrary commands. We have already fixed the vulnerability in the following version: QuNetSwitch 2.0.4.0415 and later
- 9.1 Critical severity
Media Streaming Add-on: Stack-based Buffer Overflow
A buffer overflow vulnerability has been reported to affect Media Streaming Add-On. The remote attackers can then exploit the vulnerability to modify memory or crash processes. We have already fixed the vulnerability in the following version: Media Streaming A