QNAP — known exploited vulnerabilities
The CISA Known Exploited Vulnerabilities catalog (KEV) lists vulnerabilities that CISA has confirmed are being exploited in the wild; U.S. federal civilian agencies are required to remediate each entry by its due date. This page joins the KEV entries for QNAP with NVD CVSS scores and CISA's ransomware-campaign flag. See our methodology or browse all CVEs.
Key findings
CISA's Known Exploited Vulnerabilities catalog lists 11 QNAP vulnerabilities confirmed as exploited in the wild across 5 products; 9 of them (82%) are flagged as used in known ransomware campaigns. Photo Station and Network Attached Storage (NAS) are tied as the most-affected products, with 4 entries each (36% of the total each). CISA added 1 entry in 2023, compared with 10 in 2022. Across the 11 entries with an NVD CVSS score (100% of the total), the average score is 9.2; 8 entries are rated critical by NVD. The most recent addition is CVE-2023-47565 (QNAP VioStor NVR OS Command Injection Vulnerability), added on 2023-12-21.
Affected products
| Product | Entries | Share |
|---|---|---|
| Photo Station | 4 | 36% |
| Network Attached Storage (NAS) | 4 | 36% |
| VioStor NVR | 1 | 9.1% |
| QTS | 1 | 9.1% |
| QNAP Network-Attached Storage (NAS) | 1 | 9.1% |
Entries added per year
By date added to the KEV catalog
Exploited QNAP vulnerabilities (11)
Newest first. CVSS scores from NVD where available.
| CVE | Product | Vulnerability | Date added | Ransomware | CVSS |
|---|---|---|---|---|---|
| CVE-2023-47565 | VioStor NVR | QNAP VioStor NVR OS Command Injection Vulnerability | 2023-12-21 | — | HIGH8.0 |
| CVE-2022-27593 | Photo Station | QNAP Photo Station Externally Controlled Reference Vulnerability | 2022-09-08 | Known | CRITICAL10.0 |
| CVE-2019-7195 | Photo Station | QNAP Photo Station Path Traversal Vulnerability | 2022-06-08 | Known | CRITICAL9.8 |
| CVE-2019-7194 | Photo Station | QNAP Photo Station Path Traversal Vulnerability | 2022-06-08 | Known | CRITICAL9.8 |
| CVE-2019-7193 | QTS | QNAP QTS Improper Input Validation Vulnerability | 2022-06-08 | Known | CRITICAL9.8 |
| CVE-2019-7192 | Photo Station | QNAP Photo Station Improper Access Control Vulnerability | 2022-06-08 | Known | CRITICAL9.8 |
| CVE-2018-19953 | Network Attached Storage (NAS) | QNAP NAS File Station Cross-Site Scripting Vulnerability | 2022-05-24 | Known | MEDIUM6.1 |
| CVE-2018-19949 | Network Attached Storage (NAS) | QNAP NAS File Station Command Injection Vulnerability | 2022-05-24 | Known | CRITICAL9.8 |
| CVE-2018-19943 | Network Attached Storage (NAS) | QNAP NAS File Station Cross-Site Scripting Vulnerability | 2022-05-24 | Known | HIGH8.0 |
| CVE-2020-2509 | QNAP Network-Attached Storage (NAS) | QNAP Network-Attached Storage (NAS) Command Injection Vulnerability | 2022-04-11 | — | CRITICAL9.8 |
| CVE-2021-28799 | Network Attached Storage (NAS) | QNAP NAS Improper Authorization Vulnerability | 2022-03-31 | Known | CRITICAL10.0 |
Source: CISA Known Exploited Vulnerabilities catalog, joined with NIST NVD CVSS data. Vendor names are normalized across spellings. Compare all vendors.