Vendor
Qnap Systems Inc.
591 known vulnerabilities in products by Qnap Systems Inc., 8 of them actively exploited (CISA KEV).
Key figures
591
Vulnerabilities
8
Actively exploited (KEV)
5
Used by ransomware
88
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority.
| Severity | CVE | Title | CVSS | Published |
|---|---|---|---|---|
| Critical | CVE-2022-27593 | DeadBolt Ransomware In CISA KEVRansomware | 10.0 | |
| Critical | CVE-2021-28799 | Improper Authorization Vulnerability in HBS 3 (Hybrid Backup Sync) In CISA KEVRansomware | 10.0 | |
| Critical | CVE-2018-19949 | QNAP NAS File Station Command Injection Vulnerability In CISA KEVRansomware | 9.8 | |
| Critical | CVE-2018-19943 | QNAP NAS File Station Cross-Site Scripting Vulnerability In CISA KEVRansomware | 8.0 | |
| Critical | CVE-2018-19953 | QNAP NAS File Station Cross-Site Scripting Vulnerability In CISA KEVRansomware | 6.1 | |
| Critical | CVE-2020-2509 | Command Injection Vulnerability in QTS and QuTS hero In CISA KEV | 9.8 | |
| Critical | CVE-2023-47565 | Legacy VioStor NVR In CISA KEV | 8.0 | |
| Critical | CVE-2020-2506 | improper access control vulnerability in Helpdesk In CISA KEV | 7.3 | |
| Critical | CVE-2024-21899 | QTS, QuTS hero, QuTScloud | 9.8 | |
| Critical | CVE-2024-50387 | SMB Service | 9.8 | |
| Critical | CVE-2023-23368 | QTS, QuTS hero, QuTScloud | 9.8 | |
| High | CVE-2024-53691 | QTS, QuTS hero | 8.8 | |
| High | CVE-2023-51364 | QTS, QuTS hero, QuTScloud | 8.7 | |
| High | CVE-2023-51365 | QTS, QuTS hero, QuTScloud | 8.7 | |
| Critical | CVE-2021-28809 | Missing Authentication for Critical Function in RTRR Server in HBS3 | 9.8 | |
| Critical | CVE-2023-23369 | QTS, Multimedia Console, and Media Streaming add-on | 9.0 | |
| High | CVE-2024-27130 | QTS, QuTS hero | 7.2 | |
| Critical | CVE-2021-28797 | Stack Buffer Overflow in Surveillance Station | 9.8 | |
| High | CVE-2023-47218 | QTS, QuTS hero, QuTScloud | 5.8 | |
| Critical | CVE-2024-50388 | HBS 3 Hybrid Backup Sync | 9.8 | |
| High | CVE-2020-36197 | Improper Access Control Vulnerability in Music Station | 7.1 | |
| Medium | CVE-2026-34007 | QNAP Systems Notes Station 3: OS Command Injection | — | |
| Critical | CVE-2024-32766 | QTS, QuTS hero, QuTScloud | 10.0 | |
| Critical | CVE-2020-2507 | command injection vulnerability in Helpdesk | 9.8 | |
| Critical | CVE-2026-47786 | Pre-Authentication Command Injection | — |
News
- @RISK®: The Consensus Security Vulnerability Alert: Vol. 26, Num. 24sans-atrisk-mail,
Products
| Product | CVEs | Actively exploited |
|---|---|---|
| Qts | 250 | 4 |
| Quts Hero | 228 | 1 |
| Qsync Central | 68 | 0 |
| File Station 5 | 58 | 0 |
| Qutscloud | 58 | 0 |
| Photo Station | 19 | 1 |
| Video Station | 18 | 0 |
| Qumagie | 15 | 0 |
| Qurouter | 15 | 0 |
| Notes Station 3 | 10 | 0 |
| Helpdesk | 9 | 1 |
| Media Streaming Add-on | 9 | 0 |
| Music Station | 9 | 0 |
| Qulog Center | 8 | 0 |
| Qvr | 7 | 0 |
| Download Station | 6 | 0 |
| License Center | 6 | 0 |
| Qvr Pro | 6 | 0 |
| Multimedia Console | 5 | 0 |
| Qcalagent | 5 | 0 |
| Qunetswitch | 5 | 0 |
| Qvr Elite | 5 | 0 |
| Qvr Guard | 5 | 0 |
| Hbs 3 Hybrid Backup Sync | 4 | 0 |
| Qes | 4 | 0 |
| Hybriddesk Station | 3 | 0 |
| Proxy Server | 3 | 0 |
| Qufirewall | 3 | 0 |
| Qvpn Windows | 3 | 0 |
| Surveillance Station | 3 | 0 |