QNAP vulnerabilities in CISA KEV
QNAP has 11 vulnerabilities in CISA's catalogue of flaws known to be exploited, the 25th highest of any vendor. none were added in the last 12 months; 9 are linked to known ransomware use (81.8% of its entries, against 20.4% across the catalogue). CISA's median fix window for these entries is 21 days (range 14 to 21), against 21 days (range 1 to 184) across the whole catalogue. The most exploited product is Network Attached Storage (NAS), with 4 entries. Other frequently affected products: Photo Station (4); QNAP Network-Attached Storage (NAS) (1).
Catalog v2026.11.04, released 5 Nov 2026. Source CISA ↗. All KEV entries.
$ ./kev --vendor qnap --summary
Counts are computed from the catalog release on ; the 12 month window ends there.
┌─ total entries
11
in CISA KEV
┌─ first added
2022-03-31
earliest entry
┌─ latest added
2023-12-21
most recent entry
┌─ last 12 months
0
entries added
┌─ ransomware use
9 of 11
81.8% linked to ransomware
┌─ distinct products
5
affected products
$ awk -F, {print $1} /var/log/kev/qnap.log | uniq -c
Entries by the year CISA added them.
| Year | Entries added | Of which ransomware |
|---|---|---|
| 2022 | 10 | 9 |
| 2023 | 1 | 0 |
$ sort /var/log/kev/qnap.log | uniq -c | sort -rn | head -5
The five products with the most entries in the catalogue.
- Network Attached Storage (NAS) 4 entries
- Photo Station 4 entries
- QNAP Network-Attached Storage (NAS) 1 entry
- QTS 1 entry
- VioStor NVR 1 entry
$ kev-due-dates --vendor qnap
Days between the date CISA added an entry and the due date it set, median and range. Due dates apply to US federal agencies; for everyone else they are a patch-first ranking signal.
┌─ QNAP
21 days (range 14 to 21)
median and range in days
┌─ whole catalogue
21 days (range 1 to 184)
median and range in days
$ grep -o 'CWE-[0-9]*' /var/log/kev/qnap.log | sort | uniq -c | sort -rn | head -3
Weakness types CISA records for these entries (11 of 11 have at least one CWE).
$ grep -ril 'QNAP' /var/log/news | head -5
Our reporting that names QNAP or one of its KEV CVE ids, newest first.
┌─ /var/log/news
Patch Week pages with these entries
No Patch Week page covers this vendor yet.
$ wc -l ./qnap.kev · 11 rows
Descriptions: CISA Known Exploited Vulnerabilities catalogue
- CVE-2023-47565
VioStor NVR
QNAP VioStor NVR OS Command Injection Vulnerability
due 2024-01-11 · CWE-78
$ cat CVE-2023-47565.txt
Description. QNAP VioStar NVR contains an OS command injection vulnerability that allows authenticated users to execute commands via a network.
Required action. Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- CVE-2022-27593
Photo Station [RANSOMWARE]
QNAP Photo Station Externally Controlled Reference Vulnerability
due 2022-09-29 · CWE-610
$ cat CVE-2022-27593.txt
Description. Certain QNAP NAS running Photo Station with internet exposure contain an externally controlled reference to a resource vulnerability which can allow an attacker to modify system files. This vulnerability was observed being utilized in a Deadbolt ransomware campaign.
Required action. Apply updates per vendor instructions.
- CVE-2019-7192
Photo Station [RANSOMWARE]
QNAP Photo Station Improper Access Control Vulnerability
due 2022-06-22 · CWE-863
$ cat CVE-2019-7192.txt
Description. QNAP NAS devices running Photo Station contain an improper access control vulnerability allowing remote attackers to gain unauthorized access to the system.
Required action. Apply updates per vendor instructions.
- CVE-2019-7193
QTS [RANSOMWARE]
QNAP QTS Improper Input Validation Vulnerability
due 2022-06-22 · CWE-20
$ cat CVE-2019-7193.txt
Description. QNAP QTS contains an improper input validation vulnerability allowing remote attackers to inject code on the system.
Required action. Apply updates per vendor instructions.
- CVE-2019-7194
Photo Station [RANSOMWARE]
QNAP Photo Station Path Traversal Vulnerability
due 2022-06-22 · CWE-22
$ cat CVE-2019-7194.txt
Description. QNAP devices running Photo Station contain an external control of file name or path vulnerability allowing remote attackers to access or modify system files.
Required action. Apply updates per vendor instructions.
- CVE-2019-7195
Photo Station [RANSOMWARE]
QNAP Photo Station Path Traversal Vulnerability
due 2022-06-22 · CWE-22
$ cat CVE-2019-7195.txt
Description. QNAP devices running Photo Station contain an external control of file name or path vulnerability allowing remote attackers to access or modify system files.
Required action. Apply updates per vendor instructions.
- CVE-2018-19943
Network Attached Storage (NAS) [RANSOMWARE]
QNAP NAS File Station Cross-Site Scripting Vulnerability
due 2022-06-14 · CWE-79 CWE-80
$ cat CVE-2018-19943.txt
Description. A cross-site scripting vulnerability affecting QNAP NAS File Station could allow remote attackers to inject malicious code.
Required action. Apply updates per vendor instructions.
- CVE-2018-19949
Network Attached Storage (NAS) [RANSOMWARE]
QNAP NAS File Station Command Injection Vulnerability
due 2022-06-14 · CWE-20 CWE-77 CWE-78
$ cat CVE-2018-19949.txt
Description. A command injection vulnerability affecting QNAP NAS File Station could allow remote attackers to run commands.
Required action. Apply updates per vendor instructions.
- CVE-2018-19953
Network Attached Storage (NAS) [RANSOMWARE]
QNAP NAS File Station Cross-Site Scripting Vulnerability
due 2022-06-14 · CWE-79 CWE-80
$ cat CVE-2018-19953.txt
Description. A cross-site scripting vulnerability affecting QNAP NAS File Station could allow remote attackers to inject malicious code.
Required action. Apply updates per vendor instructions.
- CVE-2020-2509
QNAP Network-Attached Storage (NAS)
QNAP Network-Attached Storage (NAS) Command Injection Vulnerability
due 2022-05-02 · CWE-77 CWE-78
$ cat CVE-2020-2509.txt
Description. QNAP NAS devices contain a command injection vulnerability which could allow attackers to perform remote code execution.
Required action. Apply updates per vendor instructions.
- CVE-2021-28799
Network Attached Storage (NAS) [RANSOMWARE]
QNAP NAS Improper Authorization Vulnerability
due 2022-04-21 · CWE-285
$ cat CVE-2021-28799.txt
Description. QNAP NAS running HBS 3 contains an improper authorization vulnerability which can allow remote attackers to log in to a device.
Required action. Apply updates per vendor instructions.