QNAP Systems Inc.
Products
| Product | CVEs | Exploited | Latest |
|---|---|---|---|
| QTS | 244 | 4 | Sep 18, 2026 |
| QuTS hero | 231 | 1 | Jun 10, 2026 |
| Photo Station | 15 | 1 | Aug 29, 2025 |
| Helpdesk | 6 | 1 | Mar 7, 2025 |
| HBS 3 | 2 | 1 | Jul 8, 2021 |
| VioStor NVR | 1 | 1 | Dec 8, 2023 |
| HBS 1.3 | 1 | 1 | May 13, 2021 |
| HBS 2 | 1 | 1 | May 13, 2021 |
| Qsync Central | 68 | – | Oct 15, 2026 |
| QuTScloud | 63 | – | Jun 10, 2026 |
| File Station 5 | 58 | – | Oct 15, 2026 |
| Video Station | 18 | – | Oct 15, 2026 |
| QuRouter | 15 | – | Oct 15, 2026 |
| QuMagie | 15 | – | Oct 15, 2026 |
| Notes Station 3 | 10 | – | Oct 15, 2026 |
| Media Streaming Add-on | 9 | – | Mar 20, 2026 |
| QVR | 8 | – | Sep 6, 2024 |
| QuLog Center | 8 | – | Nov 7, 2025 |
| QES | 6 | – | Sep 6, 2024 |
| License Center | 6 | – | Jun 10, 2026 |
| Download Station | 6 | – | Oct 15, 2026 |
| Music Station | 6 | – | Sep 6, 2024 |
| QVR Pro | 6 | – | Mar 20, 2026 |
| HBS 3 Hybrid Backup Sync | 6 | – | Oct 29, 2026 |
| QuNetSwitch | 5 | – | Mar 20, 2026 |
| QVR Guard | 5 | – | Jan 14, 2022 |
| QVR Elite | 5 | – | Jan 14, 2022 |
| Multimedia Console | 5 | – | Nov 3, 2023 |
| QcalAgent | 5 | – | Oct 15, 2026 |
| QuFirewall | 3 | – | Dec 19, 2024 |
| QVPN Windows | 3 | – | Dec 19, 2024 |
| Surveillance Station | 3 | – | Dec 29, 2021 |
| HybridDesk Station | 3 | – | Oct 15, 2026 |
| Proxy Server | 3 | – | May 26, 2022 |
| Malware Remover | 2 | – | Jan 2, 2026 |
| Q'center | 2 | – | Jul 1, 2021 |
| Qfinder Pro Mac | 2 | – | Jan 2, 2026 |
| Hybrid Backup Sync | 2 | – | Oct 29, 2026 |
| VioStor | 2 | – | Aug 29, 2025 |
| Hyper Data Protector | 2 | – | Mar 12, 2026 |
| Qsync for Mac | 2 | – | Jan 2, 2026 |
| myQNAPcloud Link | 2 | – | Apr 26, 2024 |
| QVPN Device Client for Mac | 2 | – | Jan 2, 2026 |
| QUSBCam2 | 2 | – | Oct 20, 2023 |
| QmailAgent | 2 | – | Nov 20, 2021 |
| Notification Center | 2 | – | Jun 10, 2026 |
| QSS | 2 | – | Jun 11, 2021 |
| QuFTP Service | 2 | – | Oct 15, 2026 |
| NVR Storage Expansion | 2 | – | Sep 10, 2021 |
| Image2PDF | 1 | – | Oct 1, 2021 |
| QVP | 1 | – | Jun 10, 2026 |
| MARS (Multi-Application Recovery Service) | 1 | – | Jan 2, 2026 |
| Virtualization Station | 1 | – | Oct 15, 2026 |
| QVR Smart Client | 1 | – | Sep 6, 2024 |
| QSW-M2116P-2T2S | 1 | – | Sep 10, 2021 |
| Qsirch | 1 | – | Oct 15, 2026 |
| Qfiling | 1 | – | Jan 2, 2026 |
| sMedio DTCP MOVE | 1 | – | Oct 15, 2026 |
| QNAP Authenticator | 1 | – | Oct 3, 2025 |
| NetBak Replicator | 1 | – | Oct 3, 2025 |
| Qfile | 1 | – | Dec 29, 2021 |
| myQNAPcloud | 1 | – | Mar 8, 2024 |
| QNAP AI Core | 1 | – | Nov 22, 2024 |
| QuTS cloud | 1 | – | Jun 10, 2026 |
| Kazoo Server | 1 | – | Feb 11, 2022 |
| QVR Pro Client | 1 | – | Sep 8, 2023 |
| Network & Virtual Switch | 1 | – | Oct 15, 2026 |
| SMB Service | 1 | – | Dec 6, 2024 |
| Container Station | 1 | – | Oct 13, 2023 |
Exploited and recent CVEs
- CVE-2023-47565 Legacy VioStor NVR 73.3%
- CVE-2022-27593 DeadBolt Ransomware 87.9%
- CVE-2021-28799 Improper Authorization Vulnerability in HBS 3 (Hybrid Backup Sync) 78.2%
- CVE-2021-28799 Improper Authorization Vulnerability in HBS 3 (Hybrid Backup Sync) 78.2%
- CVE-2021-28799 Improper Authorization Vulnerability in HBS 3 (Hybrid Backup Sync) 78.2%
- CVE-2020-2509 Command Injection Vulnerability in QTS and QuTS hero 34.0%
- CVE-2020-2509 Command Injection Vulnerability in QTS and QuTS hero 34.0%
- CVE-2020-2506 improper access control vulnerability in Helpdesk 2.0%
- CVE-2018-19949 If exploited, this command injection vulnerability could allow remote attackers to run arbitrary commands. QNAP has already fixed the issue in the following QTS versions. QTS 4.4.2.1231 on build 20200 30.2%
- CVE-2018-19943 If exploited, this cross-site scripting vulnerability could allow remote attackers to inject malicious code. QNAP has already fixed these issues in the following QTS versions. QTS 4.4.2.1270 build 202 22.7%
- CVE-2018-19953 If exploited, this cross-site scripting vulnerability could allow remote attackers to inject malicious code. QNAP has already fixed the issue in the following QTS versions. QTS 4.4.2.1231 on build 202 30.5%
- CVE-2025-62841 Hard-coded Cryptographic Key #2 0.2%
- CVE-2025-62841 Hard-coded Cryptographic Key #2 0.2%
- CVE-2025-62839 Hard-coded Cryptographic Key #1 0.2%
- CVE-2025-62839 Hard-coded Cryptographic Key #1 0.2%
- CVE-2026-50619 Unauthenticated remote code execution vulnerability 0.4%
- CVE-2026-47790 Privilege Escalation via QuFTP Log-based XSS 0.3%
- CVE-2026-47786 Pre-Authentication Command Injection 1.1%
- CVE-2026-39997 Unauthenticated Remote Input Injection in QNAP HD Station's remotepad 0.2%
- CVE-2026-39991 Stored Cross-Site Scripting (XSS) in Note Station file upload functionality 0.3%
- CVE-2026-34009 **Container Escape** Host user home directory mounted with write access into application container 0.1%
- CVE-2026-34008 **Privilege Escalation** World-writable crontab path monitored and executed by root-owned process <0.1%
- CVE-2026-34007 **RCE** Unsanitized `X-Forwarded-For` header passed to `shell_exec()` via broken IP validation fallback in `getClientIP()` 1.4%
- CVE-2026-53882 Path Traversal in Virtualization Station VM Import 0.4%
- CVE-2026-50612 Import Symlink Following Remote Code Execution Vulnerability in QuMagie 0.4%
- CVE-2026-44084 Access Code Forgery in Video Station leading to unauthorized media access 0.3%
- CVE-2026-41545 WebSocket timelapse path traversal and command injection 0.4%
- CVE-2026-41541 Symlink creation in qsyncsrv.cgi 0.4%
- CVE-2026-39989 SSRF in QNAP Download Station 0.3%
- CVE-2026-34015 Remote Code Execution in upload.php of Video Station 0.4%