{"meta":{"title":"KEV entries: QNAP","description":"All KEV entries for vendor QNAP.","source":"CISA Known Exploited Vulnerabilities catalog (https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json)","catalogVersion":"2026.09.23","catalogDateReleased":"2026-09-23T12:51:35.821Z","referenceDate":"2026-09-23","publisher":"Telemetry","license":"https://creativecommons.org/licenses/by/4.0/","documentation":"https://glide-telemetry.pages.dev/api/","records":11,"vendor":"QNAP","entries":11,"shareOfCatalogPercent":0.6,"ransomwareKnown":9,"firstDateAdded":"2022-03-31","latestDateAdded":"2023-12-21","rank":25},"data":[{"cveID":"CVE-2023-47565","vendorProject":"QNAP","product":"VioStor NVR","vulnerabilityName":"QNAP VioStor NVR OS Command Injection Vulnerability","dateAdded":"2023-12-21","dueDate":"2024-01-11","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-78"],"shortDescription":"QNAP VioStar NVR contains an OS command injection vulnerability that allows authenticated users to execute commands via a network.","requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","notes":"https://www.qnap.com/en/security-advisory/qsa-23-48 ;  https://nvd.nist.gov/vuln/detail/CVE-2023-47565","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2023/#cve-2023-47565"},{"cveID":"CVE-2022-27593","vendorProject":"QNAP","product":"Photo Station","vulnerabilityName":"QNAP Photo Station Externally Controlled Reference Vulnerability","dateAdded":"2022-09-08","dueDate":"2022-09-29","knownRansomwareCampaignUse":"Known","cwes":["CWE-610"],"shortDescription":"Certain QNAP NAS running Photo Station with internet exposure contain an externally controlled reference to a resource vulnerability which can allow an attacker to modify system files. This vulnerability was observed being utilized in a Deadbolt ransomware campaign.","requiredAction":"Apply updates per vendor instructions.","notes":"https://www.qnap.com/en/security-advisory/qsa-22-24;  https://nvd.nist.gov/vuln/detail/CVE-2022-27593","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2022-27593"},{"cveID":"CVE-2019-7195","vendorProject":"QNAP","product":"Photo Station","vulnerabilityName":"QNAP Photo Station Path Traversal Vulnerability","dateAdded":"2022-06-08","dueDate":"2022-06-22","knownRansomwareCampaignUse":"Known","cwes":["CWE-22"],"shortDescription":"QNAP devices running Photo Station contain an external control of file name or path vulnerability allowing remote attackers to access or modify system files.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2019-7195","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2019-7195"},{"cveID":"CVE-2019-7194","vendorProject":"QNAP","product":"Photo Station","vulnerabilityName":"QNAP Photo Station Path Traversal Vulnerability","dateAdded":"2022-06-08","dueDate":"2022-06-22","knownRansomwareCampaignUse":"Known","cwes":["CWE-22"],"shortDescription":"QNAP devices running Photo Station contain an external control of file name or path vulnerability allowing remote attackers to access or modify system files.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2019-7194","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2019-7194"},{"cveID":"CVE-2019-7193","vendorProject":"QNAP","product":"QTS","vulnerabilityName":"QNAP QTS Improper Input Validation Vulnerability","dateAdded":"2022-06-08","dueDate":"2022-06-22","knownRansomwareCampaignUse":"Known","cwes":["CWE-20"],"shortDescription":"QNAP QTS contains an improper input validation vulnerability allowing remote attackers to inject code on the system.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2019-7193","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2019-7193"},{"cveID":"CVE-2019-7192","vendorProject":"QNAP","product":"Photo Station","vulnerabilityName":"QNAP Photo Station Improper Access Control Vulnerability","dateAdded":"2022-06-08","dueDate":"2022-06-22","knownRansomwareCampaignUse":"Known","cwes":["CWE-863"],"shortDescription":"QNAP NAS devices running Photo Station contain an improper access control vulnerability allowing remote attackers to gain unauthorized access to the system.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2019-7192","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2019-7192"},{"cveID":"CVE-2018-19953","vendorProject":"QNAP","product":"Network Attached Storage (NAS)","vulnerabilityName":"QNAP NAS File Station Cross-Site Scripting Vulnerability","dateAdded":"2022-05-24","dueDate":"2022-06-14","knownRansomwareCampaignUse":"Known","cwes":["CWE-79","CWE-80"],"shortDescription":"A cross-site scripting vulnerability affecting QNAP NAS File Station could allow remote attackers to inject malicious code.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2018-19953","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2018-19953"},{"cveID":"CVE-2018-19949","vendorProject":"QNAP","product":"Network Attached Storage (NAS)","vulnerabilityName":"QNAP NAS File Station Command Injection Vulnerability","dateAdded":"2022-05-24","dueDate":"2022-06-14","knownRansomwareCampaignUse":"Known","cwes":["CWE-20","CWE-77","CWE-78"],"shortDescription":"A command injection vulnerability affecting QNAP NAS File Station could allow remote attackers to run commands.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2018-19949","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2018-19949"},{"cveID":"CVE-2018-19943","vendorProject":"QNAP","product":"Network Attached Storage (NAS)","vulnerabilityName":"QNAP NAS File Station Cross-Site Scripting Vulnerability","dateAdded":"2022-05-24","dueDate":"2022-06-14","knownRansomwareCampaignUse":"Known","cwes":["CWE-79","CWE-80"],"shortDescription":"A cross-site scripting vulnerability affecting QNAP NAS File Station could allow remote attackers to inject malicious code.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2018-19943","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2018-19943"},{"cveID":"CVE-2020-2509","vendorProject":"QNAP","product":"QNAP Network-Attached Storage (NAS)","vulnerabilityName":"QNAP Network-Attached Storage (NAS) Command Injection Vulnerability","dateAdded":"2022-04-11","dueDate":"2022-05-02","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-77","CWE-78"],"shortDescription":"QNAP NAS devices contain a command injection vulnerability which could allow attackers to perform remote code execution.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2020-2509","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2020-2509"},{"cveID":"CVE-2021-28799","vendorProject":"QNAP","product":"Network Attached Storage (NAS)","vulnerabilityName":"QNAP NAS Improper Authorization Vulnerability","dateAdded":"2022-03-31","dueDate":"2022-04-21","knownRansomwareCampaignUse":"Known","cwes":["CWE-285"],"shortDescription":"QNAP NAS running HBS 3 contains an improper authorization vulnerability which can allow remote attackers to log in to a device.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2021-28799","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2021-28799"}]}