Patchfirst
Patchfirst

Vendor

QNAP

12 of 28 QNAP CVEs in Patchfirst (43%) are in of vulnerabilities exploited in the wild, 9 of them used by ransomware.

CVEs
28
In CISA KEV
1243%
Known ransomware use
9
Median days to KEV
573
from publication
Latest KEV listing
21 Dec 2023
Watch QNAP Subscribe (RSS) JSON Feed All feeds

Products

In KEVOther CVEs
  • Photo Station In KEV: 4 CVEs: 5
  • Network Attached Storage (NAS) In KEV: 4 CVEs: 4
  • QTS In KEV: 1 CVEs: 7
  • Helpdesk In KEV: 1 CVEs: 2
  • QNAP Network-Attached Storage (NAS) In KEV: 1 CVEs: 1
  • VioStor NVR In KEV: 1 CVEs: 1
  • Malware Remover In KEV: 0 CVEs: 2
  • HybridDesk Station In KEV: 0 CVEs: 1
  • Music Station In KEV: 0 CVEs: 1
  • Q'center Virtual Appliance In KEV: 0 CVEs: 1

Top ATT&CK techniques

What attackers do with QNAP CVEs
Open in ATT&CK Navigator

Counts are QNAP CVEs linked to the technique. Each link’s provenance is on the CVE page.

QNAP CVEs

28 CVEs, by priority
  1. CVE-2021-28799QNAP NAS Improper Authorization Vulnerability
    QNAP · Network Attached Storage (NAS)KEVRansomwarePublic exploitCritical · 9.8T1190Exploit Public-Facing ApplicationT1078Valid Accounts
    78.3%Top 0.42%
    79.8priority
  2. CVE-2019-7195QNAP Photo Station Path Traversal Vulnerability
    QNAP · Photo StationKEVRansomwarePublic exploitCritical · 9.8T1190Exploit Public-Facing ApplicationT1005Data from Local System
    89.3%Top 0.22%
    79.8priority
  3. CVE-2019-7194QNAP Photo Station Path Traversal Vulnerability
    QNAP · Photo StationKEVRansomwarePublic exploitCritical · 9.8T1190Exploit Public-Facing ApplicationT1005Data from Local System
    82.7%Top 0.33%
    79.8priority
  4. CVE-2019-7192QNAP Photo Station Improper Access Control Vulnerability
    QNAP · Photo StationKEVRansomwarePublic exploitCritical · 9.8T1190Exploit Public-Facing ApplicationT1078Valid Accounts
    88.1%Top 0.23%
    79.8priority
  5. CVE-2020-2509QNAP Network-Attached Storage (NAS) Command Injection Vulnerability
    QNAP · QNAP Network-Attached Storage (NAS)KEVPublic exploitCritical · 9.8T1190Exploit Public-Facing ApplicationT1059Command and Scripting Interpreter
    34.0%Top 1.6%
    79.5priority
  6. CVE-2022-27593QNAP Photo Station Externally Controlled Reference Vulnerability
    QNAP · Photo StationKEVRansomwarePublic exploitCritical · 9.1T1190Exploit Public-Facing ApplicationT1565.001Stored Data Manipulation
    87.9%Top 0.24%
    79.3priority
  7. CVE-2019-7193QNAP QTS Improper Input Validation Vulnerability
    QNAP · QTSKEVRansomwarePublic exploitCritical · 9.8T1190Exploit Public-Facing ApplicationT1059Command and Scripting Interpreter
    14.4%Top 3.4%
    79.2priority
  8. CVE-2018-19949QNAP NAS File Station Command Injection Vulnerability
    QNAP · Network Attached Storage (NAS)KEVRansomwareCritical · 9.8T1190Exploit Public-Facing ApplicationT1059Command and Scripting Interpreter
    30.2%Top 1.8%
    74.5priority
  9. CVE-2018-19953QNAP NAS File Station Cross-Site Scripting Vulnerability
    QNAP · Network Attached Storage (NAS)KEVRansomwareMedium · 6.1T1189Drive-by CompromiseT1059.007JavaScript
    30.5%Top 1.8%
    71.9priority
  10. CVE-2018-19943QNAP NAS File Station Cross-Site Scripting Vulnerability
    QNAP · Network Attached Storage (NAS)KEVRansomwareMedium · 5.4T1189Drive-by CompromiseT1059.007JavaScript
    22.7%Top 2.3%
    71.3priority
  11. CVE-2020-36198Command Injection Vulnerability in Malware Remover
    QNAP Systems Inc. · Malware RemoverPublic exploitMedium · 6.7
    1.1%Top 34%
    69.0priority
  12. CVE-2020-36195SQL Injection Vulnerability in Multimedia Console and the Media Streaming Add-On
    QNAP Systems Inc. · QTSCritical · 9.8
    1.8%Top 22%
    67.5priority
  13. CVE-2023-47218QTS, QuTS hero, QuTScloud
    QNAP Systems Inc. · QTSPublic exploitMedium · 5.8
    89.9%Top 0.21%
    66.1priority
  14. CVE-2024-27130QTS, QuTS hero
    QNAP Systems Inc. · QTSPublic exploitHigh · 7.2
    37.5%Top 1.5%
    64.7priority
  15. CVE-2023-47565QNAP VioStor NVR OS Command Injection Vulnerability
    QNAP · VioStor NVRKEVHigh · 8.8T1496Resource HijackingT1498Network Denial of Service
    73.3%Top 0.54%
    64.1priority
  16. CVE-2025-11837Malware Remover
    QNAP Systems Inc. · Malware RemoverHigh · 8.1
    1.5%Top 25%
    63.0priority
  17. CVE-2024-21899QTS, QuTS hero, QuTScloud
    QNAP Systems Inc. · QTSCritical · 9.8
    24.4%Top 2.1%
    61.4priority
  18. CVE-2020-2506QNAP Helpdesk Improper Access Control Vulnerability
    QNAP Systems · HelpdeskKEVCritical · 9.8T1190Exploit Public-Facing ApplicationT1068Exploitation for Privilege Escalation
    2.0%Top 19%
    61.0priority
  19. CVE-2023-50358QTS, QuTS hero, QuTScloud
    QNAP Systems Inc. · QTSMedium · 5.8
    13.5%Top 3.6%
    59.7priority
  20. CVE-2020-2507command injection vulnerability in Helpdesk
    QNAP Systems Inc. · HelpdeskCritical · 9.8
    3.1%Top 12%
    59.4priority
  21. CVE-2023-45038Music Station
    QNAP Systems Inc. · Music StationPublic exploitMedium · 4.3
    1.2%Top 31%
    56.9priority
  22. CVE-2023-39296QTS, QuTS hero
    QNAP Systems Inc. · QTSHigh · 7.5
    1.6%Top 25%
    55.3priority
  23. CVE-2017-20210Photo Station
    QNAP Systems Inc. · Photo StationCritical · 9.8
    0.4%Top 69%
    48.0priority
  24. CVE-2018-0707Command injection vulnerability in change password of QNAP Q'center Virtual Appliance version 1.7.1063 and earlier…
    QNAP · Q'center Virtual AppliancePublic exploit
    58.8%Top 0.9%
    24.8priority
  25. CVE-2026-47786An OS command injection vulnerability has been reported to affect HybridDesk Station
    QNAP Systems Inc. · HybridDesk StationCritical · 9.3
    1.1%Top 35%
    21.7priority
  26. CVE-2026-50619A path traversal vulnerability has been reported to affect Qsirch
    QNAP Systems Inc. · QsirchCritical · 9.3
    0.4%Top 63%
    16.2priority
  27. CVE-2026-34006A missing authentication for critical function vulnerability has been reported to affect sMedio DTCP MOVE
    QNAP Systems Inc. · sMedio DTCP MOVECritical · 9.3
    0.4%Top 66%
    15.5priority
  28. CVE-2026-50612An unix symbolic link (symlink) following vulnerability has been reported to affect QuMagie
    QNAP Systems Inc. · QuMagieCritical · 9.4
    0.4%Top 68%
    15.2priority
↑ ↓ chooseEnter openEsc close