CveMateVulnerability intelligence

Qnap Video Station vulnerabilities

21 vulnerabilities

Known vulnerabilities in Qnap Video Station, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.

CVE-2026-44084qnap systems inc.video station+15d ago15-10-2026 09:31

An authorization bypass through user-controlled key vulnerability has been reported to affect Video Station. If exploited, the vulnerability could allow remote attackers to obtain sensitive data. We have already fixed the vulnerability in the following version: Video Station 5.8.8 and later CVE-2026-34015qnap systems inc.video station+15d ago15-10-2026 09:30

A path traversal vulnerability has been reported to affect Video Station. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed the vulnerability in the following version: Video Station 5.8.8 and later CVE-2026-26245qnap systems inc.video station+15d ago15-10-2026 09:29

A SQL injection vulnerability has been reported to affect Video Station. If a remote attacker gains a user account, they can then exploit the vulnerability to execute unauthorized code or commands. We have already fixed the vulnerability in the following version: Video Station 5.8.8 and later CVE-2026-26244qnap systems inc.video station+15d ago15-10-2026 09:29

A SQL injection vulnerability has been reported to affect Video Station. If a remote attacker gains a user account, they can then exploit the vulnerability to execute unauthorized code or commands. We have already fixed the vulnerability in the following version: Video Station 5.8.8 and later CVE-2025-66275qnap systems inc.video station+15d ago15-10-2026 06:58

A path traversal vulnerability has been reported to affect Video Station. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed the vulnerability in the following version: Video Station 5.8.5 and later CVE-2025-66272qnap systems inc.video station+15d ago15-10-2026 06:57

A path traversal vulnerability has been reported to affect Video Station. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed the vulnerability in the following version: Video Station 5.8.5 and later CVE-2021-44056qnap systems inc.video station+14y ago05-05-2022 16:50

An improper authentication vulnerability has been reported to affect QNAP device running Video Station. If exploited, this vulnerability allows attackers to compromise the security of the system. We have already fixed this vulnerability in the following versions of Video Station: Video Station 5.5.9 and later Video Station 5.3.13 and later Video Station 5.1.8 and later CVE-2021-44055qnap systems inc.video station+14y ago05-05-2022 16:50

An missing authorization vulnerability has been reported to affect QNAP device running Video Station. If exploited, this vulnerability allows remote attackers to access data or perform actions that they should not be allowed to perform. We have already fixed this vulnerability in the following versions of Video Station: Video Station 5.5.9 ( 2022/02/16 ) and later CVE-2021-28812qnap systems inc.video station+15y ago03-06-2021 02:45

A command injection vulnerability has been reported to affect certain versions of Video Station. If exploited, this vulnerability allows remote attackers to execute arbitrary commands. This issue affects: QNAP Systems Inc. Video Station versions prior to 5.5.4 on QTS 4.5.2; versions prior to 5.5.4 on QuTS hero h4.5.2; versions prior to 5.5.4 on QuTScloud c4.5.4. This issue does not affect: QNAP Systems Inc. Video Station on QTS 4.3.6; on QTS 4.3.3.CVE-2017-13071qnapvideo_station8y ago22-11-2017 17:00

QNAP has already patched this vulnerability. This security concern allows a remote attacker to run arbitrary commands on the QNAP Video Station 5.1.3 (for QTS 4.3.3), 5.2.0 (for QTS 4.3.4), and earlier.CVE-2024-14024qnap systems inc.video station+17mo ago11-03-2026 08:02

An improper certificate validation vulnerability has been reported to affect Video Station. If an attacker gains local network access who have also gained an administrator account, they can then exploit the vulnerability to compromise the security of the system. We have already fixed the vulnerability in the following version: Video Station 5.8.2 and later CVE-2024-14025qnap systems inc.video station+17mo ago11-03-2026 08:02

An SQL injection vulnerability has been reported to affect Video Station. If an attacker gains local network access who have also gained an administrator account, they can then exploit the vulnerability to execute unauthorized code or commands. We have already fixed the vulnerability in the following version: Video Station 5.8.2 and later CVE-2024-56804qnap systems inc.video station+11y ago03-10-2025 18:08

An SQL injection vulnerability has been reported to affect Video Station. If a remote attacker gains a user account, they can then exploit the vulnerability to execute unauthorized code or commands. We have already fixed the vulnerability in the following version: Video Station 5.8.4 and later CVE-2019-7184qnapvideo_station6y ago05-12-2019 16:45

This cross-site scripting (XSS) vulnerability in Video Station allows remote attackers to inject and execute scripts on the administrator’s management console. To fix this vulnerability, QNAP recommend updating Video Station to their latest versions.CVE-2023-41288qnap systems inc.video station+12y ago05-01-2024 16:19

An OS command injection vulnerability has been reported to affect Video Station. If exploited, the vulnerability could allow users to execute commands via a network. We have already fixed the vulnerability in the following version: Video Station 5.7.2 ( 2023/11/23 ) and later CVE-2023-41287qnap systems inc.video station+12y ago05-01-2024 16:19

A SQL injection vulnerability has been reported to affect Video Station. If exploited, the vulnerability could allow users to inject malicious code via a network. We have already fixed the vulnerability in the following version: Video Station 5.7.2 ( 2023/11/23 ) and later CVE-2023-47563qnap systems inc.video station+12y ago06-09-2024 16:26

An OS command injection vulnerability has been reported to affect Video Station. If exploited, the vulnerability could allow authenticated users to execute commands via a network. We have already fixed the vulnerability in the following version: Video Station 5.8.2 and later CVE-2023-34977qnap systems inc.video station+13y ago13-10-2023 19:17

A cross-site scripting (XSS) vulnerability has been reported to affect Video Station. If exploited, the vulnerability could allow authenticated users to inject malicious code via a network. We have already fixed the vulnerability in the following version: Video Station 5.7.0 ( 2023/07/27 ) and later CVE-2023-34976qnap systems inc.video station+13y ago13-10-2023 19:17

A SQL injection vulnerability has been reported to affect Video Station. If exploited, the vulnerability could allow authenticated users to inject malicious code via a network. We have already fixed the vulnerability in the following version: Video Station 5.7.0 ( 2023/07/27 ) and later CVE-2023-34975qnap systems inc.qts+23y ago13-10-2023 19:17

An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated administrators to execute commands via a network. QuTScloud is not affected. We have already fixed the vulnerability in the following versions: QuTS hero h4.5.4.2626 build 20231225 and later QTS 4.5.4.2627 build 20231225 and later