{"id":"CVE-2026-34006","published":"2026-10-15T10:17:13Z","modified":"2026-10-15T16:32:39Z","title":"A missing authentication for critical function vulnerability has been reported to affect sMedio DTCP MOVE","vendor":"QNAP Systems Inc.","product":"sMedio DTCP MOVE","tier":"core","eol":null,"description":{"text":"A missing authentication for critical function vulnerability has been reported to affect sMedio DTCP MOVE. If exploited, the vulnerability could allow remote attackers to gain access to the system.\n\nWe have already fixed the vulnerability in the following version:\nsMedio DTCP MOVE 1.4.5 and later","provenance":"source","from":"NVD"},"summary":{"text":"A missing authentication for critical function flaw affects the sMedio DTCP MOVE product from QNAP Systems Inc. The flaw is in the product's critical function handling, which lacks an authentication requirement. An attacker with network access can remotely reach and gain access to the system without authenticating, user interaction or any specific configuration being needed.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T07:18:20Z"},"cvss":{"score":9.3,"severity":"CRITICAL","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","provenance":"source","from":"NVD"},"epss":{"score":0.00395,"percentile":0.33731,"date":"2026-10-31","provenance":"source"},"kev":null,"vulncheckKev":null,"exploited":false,"otx":null,"cwes":[{"id":"CWE-306","name":"Missing Authentication for Critical Functionality"}],"references":[{"url":"https://www.qnap.com/en/app-release-notes?keyword=sMedio&app=sMedioDTCPServer&product-line=nas","tags":[]}],"techniques":[],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2026-101974","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-101974","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":null,"exploitRefs":[],"flow":[],"timeline":[{"date":"2026-10-15","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-34006","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":null},"priority":{"score":13.3,"factors":[{"name":"In a KEV catalog","points":0.0,"detail":"not listed"},{"name":"Recent KEV listing","points":0.0,"detail":"not listed"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":6.75,"detail":"percentile 0.3373"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":0.0,"detail":"none found"},{"name":"Mentioned in OTX pulses","points":0.0,"detail":"0 pulses"},{"name":"CVSS severity","points":6.51,"detail":"base score 9.3"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}