QNAP: security record
CISA's Known Exploited Vulnerabilities catalog lists 12 flaws in QNAP cameras and video recorders and home storage and media servers that attackers have exploited in the wild, added between 25 March 2022 and 21 December 2023. CISA marks 9 as known to have been used in ransomware campaigns.
What this list means
CISA adds a flaw to its Known Exploited Vulnerabilities catalog when there is reliable evidence that attackers have used it in the wild and clear steps exist to fix or reduce it. A listed flaw usually has a patch or workaround from the maker. Some older devices are no longer supported and will not be fixed. If you own an affected model, check the maker's notice, update the firmware or replace the device if it is out of support.
QNAP VioStor NVR OS Command Injection Vulnerability
QNAP VioStar NVR contains an OS command injection vulnerability that allows authenticated users to execute commands via a network.
QNAP Photo Station Externally Controlled Reference Vulnerability
Certain QNAP NAS running Photo Station with internet exposure contain an externally controlled reference to a resource vulnerability which can allow an attacker to modify system files. This vulnerability was observed being utilized in a Deadbolt ransomware campaign.
QNAP Photo Station Path Traversal Vulnerability
QNAP devices running Photo Station contain an external control of file name or path vulnerability allowing remote attackers to access or modify system files.
QNAP Photo Station Path Traversal Vulnerability
QNAP devices running Photo Station contain an external control of file name or path vulnerability allowing remote attackers to access or modify system files.
QNAP QTS Improper Input Validation Vulnerability
QNAP QTS contains an improper input validation vulnerability allowing remote attackers to inject code on the system.
QNAP Photo Station Improper Access Control Vulnerability
QNAP NAS devices running Photo Station contain an improper access control vulnerability allowing remote attackers to gain unauthorized access to the system.
QNAP NAS File Station Cross-Site Scripting Vulnerability
A cross-site scripting vulnerability affecting QNAP NAS File Station could allow remote attackers to inject malicious code.
QNAP NAS File Station Command Injection Vulnerability
A command injection vulnerability affecting QNAP NAS File Station could allow remote attackers to run commands.
QNAP NAS File Station Cross-Site Scripting Vulnerability
A cross-site scripting vulnerability affecting QNAP NAS File Station could allow remote attackers to inject malicious code.
QNAP Network-Attached Storage (NAS) Command Injection Vulnerability
QNAP NAS devices contain a command injection vulnerability which could allow attackers to perform remote code execution.
QNAP NAS Improper Authorization Vulnerability
QNAP NAS running HBS 3 contains an improper authorization vulnerability which can allow remote attackers to log in to a device.
QNAP Helpdesk Improper Access Control Vulnerability
QNAP Helpdesk contains an improper access control vulnerability which could allow an attacker to gain privileges or to read sensitive information.
A listing shows that a flaw was exploited, not how a maker compares overall. Makers with many devices in use tend to appear more often. Check the maker's own notice for the models and firmware versions affected.
Sources
- Cybersecurity and Infrastructure Security Agency (CISA), Known Exploited Vulnerabilities Catalog, version 2026.10.28, released 28 October 2026
- National Institute of Standards and Technology, National Vulnerability Database
Checked 29 October 2026.