Qnap QTS and QuTS hero Cross-site Scripting (CVE-2026-41539)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(505909);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/07/31");

  script_cve_id("CVE-2026-41539");

  script_name(english:"Qnap QTS and QuTS hero Cross-site Scripting (CVE-2026-41539)");

  script_set_attribute(attribute:"synopsis", value:
"The remote OT asset is affected by a vulnerability.");
  script_set_attribute(attribute:"description", value:
"A cross-site scripting (XSS) vulnerability has been reported to affect
several QNAP operating system versions. The remote attackers can then
exploit the vulnerability to bypass security mechanisms or read
application data. We have already fixed the vulnerability in the
following versions: QTS 5.2.9.3492 build 20260507 and later QuTS hero
h5.2.9.3499 build 20260514 and later QuTS hero h5.3.4.3500 build
20260520 and later QuTS hero h6.0.0.3500 build 20260520 and later

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.");
  script_set_attribute(attribute:"see_also", value:"https://www.qnap.com/en/security-advisory/qsa-26-10");
  script_set_attribute(attribute:"solution", value:
"Refer to the vendor advisory.");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-41539");
  script_cwe_id(79);

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/06/09");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/06/09");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/07/31");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:qnap:qts:5.2.0.2737:build_20240417");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:qnap:qts:5.2.0.2744:build_20240424");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:qnap:qts:5.2.0.2782:build_20240601");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:qnap:qts:5.2.0.2802:build_20240620");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:qnap:qts:5.2.0.2823:build_20240711");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:qnap:qts:5.2.0.2851:build_20240808");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:qnap:qts:5.2.0.2860:build_20240817");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:qnap:qts:5.2.1.2930:build_20241025");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:qnap:qts:5.2.2.2950:build_20241114");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:qnap:qts:5.2.3.3006:build_20250108");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:qnap:qts:5.2.4.3070:build_20250312");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:qnap:qts:5.2.4.3079:build_20250321");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:qnap:qts:5.2.4.3092:build_20250403");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:qnap:qts:5.2.5.3145:build_20250526");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:qnap:qts:5.2.6.3195:build_20250715");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:qnap:qts:5.2.6.3229:build_20250818");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:qnap:qts:5.2.7.3256:build_20250913");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:qnap:qts:5.2.7.3297:build_20251024");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:qnap:qts:5.2.8.3332:build_20251128");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:qnap:qts:5.2.8.3350:build_20251216");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:qnap:qts:5.2.8.3359:build_20251225");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:qnap:qts:5.2.9.3410:build_20260214");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:qnap:qts:5.2.9.3451:build_20260327");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:qnap:quts_hero:h5.2.0.2737:build_20240417");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:qnap:quts_hero:h5.2.0.2782:build_20240601");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:qnap:quts_hero:h5.2.0.2789:build_20240607");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:qnap:quts_hero:h5.2.0.2802:build_20240620");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:qnap:quts_hero:h5.2.0.2823:build_20240711");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:qnap:quts_hero:h5.2.0.2851:build_20240808");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:qnap:quts_hero:h5.2.0.2860:build_20240817");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:qnap:quts_hero:h5.2.1.2929:build_20241025");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:qnap:quts_hero:h5.2.1.2940:build_20241105");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:qnap:quts_hero:h5.2.2.2952:build_20241116");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:qnap:quts_hero:h5.2.3.3006:build_20250108");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:qnap:quts_hero:h5.2.4.3070:build_20250312");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:qnap:quts_hero:h5.2.4.3079:build_20250321");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:qnap:quts_hero:h5.2.5.3138:build_20250519");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:qnap:quts_hero:h5.2.6.3195:build_20250715");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:qnap:quts_hero:h5.2.7.3256:build_20250913");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:qnap:quts_hero:h5.2.7.3297:build_20251024");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:qnap:quts_hero:h5.2.8.3321:build_20251117");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:qnap:quts_hero:h5.2.8.3350:build_20251216");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:qnap:quts_hero:h5.2.8.3359:build_20251225");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:qnap:quts_hero:h5.2.9.3410:build_20260214");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:qnap:quts_hero:h5.2.9.3492:build_20260507");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:qnap:quts_hero:h5.3.0.3115:build_20250430");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:qnap:quts_hero:h5.3.0.3145:build_20250530");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:qnap:quts_hero:h5.3.0.3192:build_20250716");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:qnap:quts_hero:h5.3.1.3250:build_20250912");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:qnap:quts_hero:h5.3.1.3292:build_20251024");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:qnap:quts_hero:h5.3.2.3354:build_20251225");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:qnap:quts_hero:h5.3.3.3424:build_20260305");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:qnap:quts_hero:h6.0.0.3324:build_20251125");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:qnap:quts_hero:h6.0.0.3382:build_20260122");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:qnap:quts_hero:h6.0.0.3397:build_20260206");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:qnap:quts_hero:h6.0.0.3459:build_20260409");
  script_set_attribute(attribute:"generated_plugin", value:"former");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Tenable.ot");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("tenable_ot_api_integration.nasl");
  script_require_keys("Tenable.ot/Qnap");

  exit(0);
}


include('tenable_ot_cve_funcs.inc');

get_kb_item_or_exit('Tenable.ot/Qnap');

var asset = tenable_ot::assets::get(vendor:'Qnap');

var vuln_cpes = {
    "cpe:/o:qnap:qts:5.2.0.2737:build_20240417" :
        {"versionEndIncluding" : "5.2.0.2737", "versionStartIncluding" : "5.2.0.2737", "family" : "QTS"},
    "cpe:/o:qnap:qts:5.2.0.2744:build_20240424" :
        {"versionEndIncluding" : "5.2.0.2744", "versionStartIncluding" : "5.2.0.2744", "family" : "QTS"},
    "cpe:/o:qnap:qts:5.2.0.2782:build_20240601" :
        {"versionEndIncluding" : "5.2.0.2782", "versionStartIncluding" : "5.2.0.2782", "family" : "QTS"},
    "cpe:/o:qnap:qts:5.2.0.2802:build_20240620" :
        {"versionEndIncluding" : "5.2.0.2802", "versionStartIncluding" : "5.2.0.2802", "family" : "QTS"},
    "cpe:/o:qnap:qts:5.2.0.2823:build_20240711" :
        {"versionEndIncluding" : "5.2.0.2823", "versionStartIncluding" : "5.2.0.2823", "family" : "QTS"},
    "cpe:/o:qnap:qts:5.2.0.2851:build_20240808" :
        {"versionEndIncluding" : "5.2.0.2851", "versionStartIncluding" : "5.2.0.2851", "family" : "QTS"},
    "cpe:/o:qnap:qts:5.2.0.2860:build_20240817" :
        {"versionEndIncluding" : "5.2.0.2860", "versionStartIncluding" : "5.2.0.2860", "family" : "QTS"},
    "cpe:/o:qnap:qts:5.2.1.2930:build_20241025" :
        {"versionEndIncluding" : "5.2.1.2930", "versionStartIncluding" : "5.2.1.2930", "family" : "QTS"},
    "cpe:/o:qnap:qts:5.2.2.2950:build_20241114" :
        {"versionEndIncluding" : "5.2.2.2950", "versionStartIncluding" : "5.2.2.2950", "family" : "QTS"},
    "cpe:/o:qnap:qts:5.2.3.3006:build_20250108" :
        {"versionEndIncluding" : "5.2.3.3006", "versionStartIncluding" : "5.2.3.3006", "family" : "QTS"},
    "cpe:/o:qnap:qts:5.2.4.3070:build_20250312" :
        {"versionEndIncluding" : "5.2.4.3070", "versionStartIncluding" : "5.2.4.3070", "family" : "QTS"},
    "cpe:/o:qnap:qts:5.2.4.3079:build_20250321" :
        {"versionEndIncluding" : "5.2.4.3079", "versionStartIncluding" : "5.2.4.3079", "family" : "QTS"},
    "cpe:/o:qnap:qts:5.2.4.3092:build_20250403" :
        {"versionEndIncluding" : "5.2.4.3092", "versionStartIncluding" : "5.2.4.3092", "family" : "QTS"},
    "cpe:/o:qnap:qts:5.2.5.3145:build_20250526" :
        {"versionEndIncluding" : "5.2.5.3145", "versionStartIncluding" : "5.2.5.3145", "family" : "QTS"},
    "cpe:/o:qnap:qts:5.2.6.3195:build_20250715" :
        {"versionEndIncluding" : "5.2.6.3195", "versionStartIncluding" : "5.2.6.3195", "family" : "QTS"},
    "cpe:/o:qnap:qts:5.2.6.3229:build_20250818" :
        {"versionEndIncluding" : "5.2.6.3229", "versionStartIncluding" : "5.2.6.3229", "family" : "QTS"},
    "cpe:/o:qnap:qts:5.2.7.3256:build_20250913" :
        {"versionEndIncluding" : "5.2.7.3256", "versionStartIncluding" : "5.2.7.3256", "family" : "QTS"},
    "cpe:/o:qnap:qts:5.2.7.3297:build_20251024" :
        {"versionEndIncluding" : "5.2.7.3297", "versionStartIncluding" : "5.2.7.3297", "family" : "QTS"},
    "cpe:/o:qnap:qts:5.2.8.3332:build_20251128" :
        {"versionEndIncluding" : "5.2.8.3332", "versionStartIncluding" : "5.2.8.3332", "family" : "QTS"},
    "cpe:/o:qnap:qts:5.2.8.3350:build_20251216" :
        {"versionEndIncluding" : "5.2.8.3350", "versionStartIncluding" : "5.2.8.3350", "family" : "QTS"},
    "cpe:/o:qnap:qts:5.2.8.3359:build_20251225" :
        {"versionEndIncluding" : "5.2.8.3359", "versionStartIncluding" : "5.2.8.3359", "family" : "QTS"},
    "cpe:/o:qnap:qts:5.2.9.3410:build_20260214" :
        {"versionEndIncluding" : "5.2.9.3410", "versionStartIncluding" : "5.2.9.3410", "family" : "QTS"},
    "cpe:/o:qnap:qts:5.2.9.3451:build_20260327" :
        {"versionEndIncluding" : "5.2.9.3451", "versionStartIncluding" : "5.2.9.3451", "family" : "QTS"},
    "cpe:/o:qnap:quts_hero:h5.2.0.2737:build_20240417" :
        {"versionEndIncluding" : "h5.2.0.2737", "versionStartIncluding" : "h5.2.0.2737", "family" : "QuTShero"},
    "cpe:/o:qnap:quts_hero:h5.2.0.2782:build_20240601" :
        {"versionEndIncluding" : "h5.2.0.2782", "versionStartIncluding" : "h5.2.0.2782", "family" : "QuTShero"},
    "cpe:/o:qnap:quts_hero:h5.2.0.2789:build_20240607" :
        {"versionEndIncluding" : "h5.2.0.2789", "versionStartIncluding" : "h5.2.0.2789", "family" : "QuTShero"},
    "cpe:/o:qnap:quts_hero:h5.2.0.2802:build_20240620" :
        {"versionEndIncluding" : "h5.2.0.2802", "versionStartIncluding" : "h5.2.0.2802", "family" : "QuTShero"},
    "cpe:/o:qnap:quts_hero:h5.2.0.2823:build_20240711" :
        {"versionEndIncluding" : "h5.2.0.2823", "versionStartIncluding" : "h5.2.0.2823", "family" : "QuTShero"},
    "cpe:/o:qnap:quts_hero:h5.2.0.2851:build_20240808" :
        {"versionEndIncluding" : "h5.2.0.2851", "versionStartIncluding" : "h5.2.0.2851", "family" : "QuTShero"},
    "cpe:/o:qnap:quts_hero:h5.2.0.2860:build_20240817" :
        {"versionEndIncluding" : "h5.2.0.2860", "versionStartIncluding" : "h5.2.0.2860", "family" : "QuTShero"},
    "cpe:/o:qnap:quts_hero:h5.2.1.2929:build_20241025" :
        {"versionEndIncluding" : "h5.2.1.2929", "versionStartIncluding" : "h5.2.1.2929", "family" : "QuTShero"},
    "cpe:/o:qnap:quts_hero:h5.2.1.2940:build_20241105" :
        {"versionEndIncluding" : "h5.2.1.2940", "versionStartIncluding" : "h5.2.1.2940", "family" : "QuTShero"},
    "cpe:/o:qnap:quts_hero:h5.2.2.2952:build_20241116" :
        {"versionEndIncluding" : "h5.2.2.2952", "versionStartIncluding" : "h5.2.2.2952", "family" : "QuTShero"},
    "cpe:/o:qnap:quts_hero:h5.2.3.3006:build_20250108" :
        {"versionEndIncluding" : "h5.2.3.3006", "versionStartIncluding" : "h5.2.3.3006", "family" : "QuTShero"},
    "cpe:/o:qnap:quts_hero:h5.2.4.3070:build_20250312" :
        {"versionEndIncluding" : "h5.2.4.3070", "versionStartIncluding" : "h5.2.4.3070", "family" : "QuTShero"},
    "cpe:/o:qnap:quts_hero:h5.2.4.3079:build_20250321" :
        {"versionEndIncluding" : "h5.2.4.3079", "versionStartIncluding" : "h5.2.4.3079", "family" : "QuTShero"},
    "cpe:/o:qnap:quts_hero:h5.2.5.3138:build_20250519" :
        {"versionEndIncluding" : "h5.2.5.3138", "versionStartIncluding" : "h5.2.5.3138", "family" : "QuTShero"},
    "cpe:/o:qnap:quts_hero:h5.2.6.3195:build_20250715" :
        {"versionEndIncluding" : "h5.2.6.3195", "versionStartIncluding" : "h5.2.6.3195", "family" : "QuTShero"},
    "cpe:/o:qnap:quts_hero:h5.2.7.3256:build_20250913" :
        {"versionEndIncluding" : "h5.2.7.3256", "versionStartIncluding" : "h5.2.7.3256", "family" : "QuTShero"},
    "cpe:/o:qnap:quts_hero:h5.2.7.3297:build_20251024" :
        {"versionEndIncluding" : "h5.2.7.3297", "versionStartIncluding" : "h5.2.7.3297", "family" : "QuTShero"},
    "cpe:/o:qnap:quts_hero:h5.2.8.3321:build_20251117" :
        {"versionEndIncluding" : "h5.2.8.3321", "versionStartIncluding" : "h5.2.8.3321", "family" : "QuTShero"},
    "cpe:/o:qnap:quts_hero:h5.2.8.3350:build_20251216" :
        {"versionEndIncluding" : "h5.2.8.3350", "versionStartIncluding" : "h5.2.8.3350", "family" : "QuTShero"},
    "cpe:/o:qnap:quts_hero:h5.2.8.3359:build_20251225" :
        {"versionEndIncluding" : "h5.2.8.3359", "versionStartIncluding" : "h5.2.8.3359", "family" : "QuTShero"},
    "cpe:/o:qnap:quts_hero:h5.2.9.3410:build_20260214" :
        {"versionEndIncluding" : "h5.2.9.3410", "versionStartIncluding" : "h5.2.9.3410", "family" : "QuTShero"},
    "cpe:/o:qnap:quts_hero:h5.2.9.3492:build_20260507" :
        {"versionEndIncluding" : "h5.2.9.3492", "versionStartIncluding" : "h5.2.9.3492", "family" : "QuTShero"},
    "cpe:/o:qnap:quts_hero:h5.3.0.3115:build_20250430" :
        {"versionEndIncluding" : "h5.3.0.3115", "versionStartIncluding" : "h5.3.0.3115", "family" : "QuTShero"},
    "cpe:/o:qnap:quts_hero:h5.3.0.3145:build_20250530" :
        {"versionEndIncluding" : "h5.3.0.3145", "versionStartIncluding" : "h5.3.0.3145", "family" : "QuTShero"},
    "cpe:/o:qnap:quts_hero:h5.3.0.3192:build_20250716" :
        {"versionEndIncluding" : "h5.3.0.3192", "versionStartIncluding" : "h5.3.0.3192", "family" : "QuTShero"},
    "cpe:/o:qnap:quts_hero:h5.3.1.3250:build_20250912" :
        {"versionEndIncluding" : "h5.3.1.3250", "versionStartIncluding" : "h5.3.1.3250", "family" : "QuTShero"},
    "cpe:/o:qnap:quts_hero:h5.3.1.3292:build_20251024" :
        {"versionEndIncluding" : "h5.3.1.3292", "versionStartIncluding" : "h5.3.1.3292", "family" : "QuTShero"},
    "cpe:/o:qnap:quts_hero:h5.3.2.3354:build_20251225" :
        {"versionEndIncluding" : "h5.3.2.3354", "versionStartIncluding" : "h5.3.2.3354", "family" : "QuTShero"},
    "cpe:/o:qnap:quts_hero:h5.3.3.3424:build_20260305" :
        {"versionEndIncluding" : "h5.3.3.3424", "versionStartIncluding" : "h5.3.3.3424", "family" : "QuTShero"},
    "cpe:/o:qnap:quts_hero:h6.0.0.3324:build_20251125" :
        {"versionEndIncluding" : "h6.0.0.3324", "versionStartIncluding" : "h6.0.0.3324", "family" : "QuTShero"},
    "cpe:/o:qnap:quts_hero:h6.0.0.3382:build_20260122" :
        {"versionEndIncluding" : "h6.0.0.3382", "versionStartIncluding" : "h6.0.0.3382", "family" : "QuTShero"},
    "cpe:/o:qnap:quts_hero:h6.0.0.3397:build_20260206" :
        {"versionEndIncluding" : "h6.0.0.3397", "versionStartIncluding" : "h6.0.0.3397", "family" : "QuTShero"},
    "cpe:/o:qnap:quts_hero:h6.0.0.3459:build_20260409" :
        {"versionEndIncluding" : "h6.0.0.3459", "versionStartIncluding" : "h6.0.0.3459", "family" : "QuTShero"}
};

tenable_ot::cve::compare_and_report(asset:asset, cpes:vuln_cpes, severity:SECURITY_HOLE);