AppYour homeOperatorJournalAlerts
Request an introduction
Being used in attacks, by company

QNAP flaws being used in attacks

CISA lists 11 flaws in QNAP products as being used in attacks, most recently on 21 Dec 2023. 9 have been used in ransomware.

QNAPBeing used in attacks
On CISA’s list
11 flaws, added between 31 Mar 2022 and 21 Dec 2023
Most recent
CVE-2023-47565, QNAP VioStor NVR OS Command Injection Vulnerability, added 21 Dec 2023
Used in ransomware
9 flaws, according to CISA
Products
Network Attached Storage (NAS) (4), Photo Station (4), QNAP Network-Attached Storage (NAS) (1), QTS (1), VioStor NVR (1)
What’s known.From CISA’s Known Exploited Vulnerabilities catalog, updated 21 Oct 2026.

What to do

  1. Update every QNAP product you use.Install the updates QNAP offers, on every device, and restart when asked. Each flaw below has a fix or clear advice; that’s one of CISA’s conditions for listing it.
  2. If someone looks after IT for you, send them this page.Many of these are in equipment you don’t see: routers, firewalls, servers, the office network. Ask them to confirm each one is fixed, or that you don’t use the product.
  3. Check anything else in the lookup.Search any app, company or CVE. Not being on CISA’s list doesn’t mean safe: keep updating either way.
Search QNAP in the lookupLook up something else

Every flaw, newest first

  1. Being used in attacks
    QNAP VioStor NVR
    CVE-2023-47565QNAP VioStor NVR OS Command Injection Vulnerability
    QNAP VioStar NVR contains an OS command injection vulnerability that allows authenticated users to execute commands via a network.
    CISA’s required actionApply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
    CVE recordNVD
  2. Being used in attacksUsed in ransomware
    QNAP Photo Station
    CVE-2022-27593QNAP Photo Station Externally Controlled Reference Vulnerability
    Certain QNAP NAS running Photo Station with internet exposure contain an externally controlled reference to a resource vulnerability which can allow an attacker to modify system files. This vulnerability was observed being utilized in a Deadbolt ransomware campaign.
    CISA’s required actionApply updates per vendor instructions.
    CVE recordNVD
  3. Being used in attacksUsed in ransomware
    QNAP Photo Station
    CVE-2019-7195QNAP Photo Station Path Traversal Vulnerability
    QNAP devices running Photo Station contain an external control of file name or path vulnerability allowing remote attackers to access or modify system files.
    CISA’s required actionApply updates per vendor instructions.
    CVE recordNVD
  4. Being used in attacksUsed in ransomware
    QNAP Photo Station
    CVE-2019-7194QNAP Photo Station Path Traversal Vulnerability
    QNAP devices running Photo Station contain an external control of file name or path vulnerability allowing remote attackers to access or modify system files.
    CISA’s required actionApply updates per vendor instructions.
    CVE recordNVD
  5. Being used in attacksUsed in ransomware
    QNAP QTS
    CVE-2019-7193QNAP QTS Improper Input Validation Vulnerability
    QNAP QTS contains an improper input validation vulnerability allowing remote attackers to inject code on the system.
    CISA’s required actionApply updates per vendor instructions.
    CVE recordNVD
  6. Being used in attacksUsed in ransomware
    QNAP Photo Station
    CVE-2019-7192QNAP Photo Station Improper Access Control Vulnerability
    QNAP NAS devices running Photo Station contain an improper access control vulnerability allowing remote attackers to gain unauthorized access to the system.
    CISA’s required actionApply updates per vendor instructions.
    CVE recordNVD
  7. Being used in attacksUsed in ransomware
    QNAP Network Attached Storage (NAS)
    CVE-2018-19953QNAP NAS File Station Cross-Site Scripting Vulnerability
    A cross-site scripting vulnerability affecting QNAP NAS File Station could allow remote attackers to inject malicious code.
    CISA’s required actionApply updates per vendor instructions.
    CVE recordNVD
  8. Being used in attacksUsed in ransomware
    QNAP Network Attached Storage (NAS)
    CVE-2018-19949QNAP NAS File Station Command Injection Vulnerability
    A command injection vulnerability affecting QNAP NAS File Station could allow remote attackers to run commands.
    CISA’s required actionApply updates per vendor instructions.
    CVE recordNVD
  9. Being used in attacksUsed in ransomware
    QNAP Network Attached Storage (NAS)
    CVE-2018-19943QNAP NAS File Station Cross-Site Scripting Vulnerability
    A cross-site scripting vulnerability affecting QNAP NAS File Station could allow remote attackers to inject malicious code.
    CISA’s required actionApply updates per vendor instructions.
    CVE recordNVD
  10. Being used in attacks
    QNAP Network-Attached Storage (NAS)
    CVE-2020-2509QNAP Network-Attached Storage (NAS) Command Injection Vulnerability
    QNAP NAS devices contain a command injection vulnerability which could allow attackers to perform remote code execution.
    CISA’s required actionApply updates per vendor instructions.
    CVE recordNVD
  11. Being used in attacksUsed in ransomware
    QNAP Network Attached Storage (NAS)
    CVE-2021-28799QNAP NAS Improper Authorization Vulnerability
    QNAP NAS running HBS 3 contains an improper authorization vulnerability which can allow remote attackers to log in to a device.
    CISA’s required actionApply updates per vendor instructions.
    CVE recordNVD

From CISA’s Known Exploited Vulnerabilities catalog, updated 21 Oct 2026 (version 2026.10.21). CISA’s required actions are written for US government agencies. QNAP on CISA’s site.

Every companyLookup · HARD’s advisories · Alerts