Cyberfeed6 › Vendors › QNAP
CISA lists 11 QNAP vulnerabilities as exploited in real attacks, and 9 of them are known to be used in ransomware campaigns. Most entries concern Photo Station, Network Attached Storage (NAS), VioStor NVR, QTS.
Showing the 11 most recently added of 11. Check the vendor notice before you act: it names the fixed versions.
| Vulnerability | Product | Added to list | Severity | Ransomware | Fix |
|---|---|---|---|---|---|
| CVE-2023-47565QNAP VioStor NVR OS Command Injection Vulnerability | VioStor NVR | 2023-12-21 | High (8.0) | No | Vendor notice |
| CVE-2022-27593QNAP Photo Station Externally Controlled Reference Vulnerability | Photo Station | 2022-09-08 | Critical (10.0) | Yes | Vendor notice |
| CVE-2019-7195QNAP Photo Station Path Traversal Vulnerability | Photo Station | 2022-06-08 | Critical (9.8) | Yes | |
| CVE-2019-7194QNAP Photo Station Path Traversal Vulnerability | Photo Station | 2022-06-08 | Critical (9.8) | Yes | |
| CVE-2019-7193QNAP QTS Improper Input Validation Vulnerability | QTS | 2022-06-08 | Critical (9.8) | Yes | |
| CVE-2019-7192QNAP Photo Station Improper Access Control Vulnerability | Photo Station | 2022-06-08 | Critical (9.8) | Yes | |
| CVE-2018-19953QNAP NAS File Station Cross-Site Scripting Vulnerability | Network Attached Storage (NAS) | 2022-05-24 | Medium (6.1) | Yes | |
| CVE-2018-19949QNAP NAS File Station Command Injection Vulnerability | Network Attached Storage (NAS) | 2022-05-24 | Critical (9.8) | Yes | |
| CVE-2018-19943QNAP NAS File Station Cross-Site Scripting Vulnerability | Network Attached Storage (NAS) | 2022-05-24 | High (8.0) | Yes | |
| CVE-2020-2509QNAP Network-Attached Storage (NAS) Command Injection Vulnerability | QNAP Network-Attached Storage (NAS) | 2022-04-11 | Critical (9.8) | No | |
| CVE-2021-28799QNAP NAS Improper Authorization Vulnerability | Network Attached Storage (NAS) | 2022-03-31 | Critical (10.0) | Yes |
Source: CISA Known Exploited Vulnerabilities catalog, released 2026-11-04. Severity scores are CVSS where available. "Ransomware" means CISA has marked the flaw as known to be used in ransomware campaigns.