CVE-2021-34348

CVE-2021-34348 describes a command-injection vulnerability in QNAP QVR. Reports indicate an attack could allow a remote attacker to execute arbitrary commands due to input validation weaknesses in QVR on affected QNAP devices. The vulnerability is mitigated in newer releases; QVR 5.1.5 build 2021...

CVE-2022-27588

CVE-2022-27588 affects QNAP QVR (VS Series NVR) with a command injection vulnerability. Affected software versions include pre-5.1.6 build 20220401; the issue allows remote arbitrary command execution without authentication. The vulnerability has been fixed in QVR 5.1.6 build 20220401 and later. ...

CVE-2023-23355

CVE-2023-23355 is an OS command injection affecting QNAP QTS/QuTS hero/QuTScloud (QVR/QVP-related appliances). The vulnerability could allow remote authenticated administrators to execute commands via unspecified vectors; QES is not affected. Affected products and fixed versions are explicitly li...

CVE-2021-34351

CVE-2021-34351 is a command-injection vulnerability in QNAP QVR . It arises from insufficient input validation in the QVR component, allowing a remote attacker to execute arbitrary commands over the network. The issue affects QVR prior to the fixed release, with a fix provided in QVR 5.1.5 build ...

CVE-2022-27597

CVE-2022-27597 affects QNAP QTS, QuTS hero, QuTScloud, and QVP (QVR Pro appliances). A out-of-bounds read vulnerability could allow remote authenticated administrators to obtain secret values. Affected components are not detailed beyond the OS families; root cause is described as an out-of-bounds...

CVE-2021-34349

CVE-2021-34349 concerns a command-injection vulnerability in QNAP QVR. The vulnerability could allow remote attackers to execute arbitrary commands on affected QVR instances. QNAP states the issue is fixed in QVR 5.1.5 build 20210803 and later. CVSS scores in the connected data indicate a high-se...

CVE-2021-34352

CVE-2021-34352 describes a command injection vulnerability in QNAP QVR . The issue could allow a remote attacker to execute arbitrary commands on affected devices. The advisory states exploitation is possible remotely and notes that mitigation is to update to version QVR 5.1.5 build 20210902 or l...

CVE-2021-38686

CVE-2021-38686 is an improper authentication vulnerability impacting QNAP VioStor/NVR via QVR. The issue allows remote compromise; CVSSv3.1 base score 8.8 (HIGH) with network access and required user interaction. A fix is available in QVR FW 5.1.6 build 20211109 and later. Exploitation status is ...

CVE-2021-38685

CVE-2021-38685 is a remote command-injection vulnerability affecting QNAP VioStor/NVR software (QVR). The issue allows an unauthenticated remote attacker to execute arbitrary commands, with high impact on confidentiality, integrity, and availability (CVSS v3.1 base score 9.8). Affected fix: firmw...

CVE-2025-52856

The CVE-2025-52856 vulnerability affects QNAP VioStor. Description confirms an improper authentication flaw that could allow a remote attacker to compromise the system. The issue is addressed in VioStor 5.1.6 build 20250621 and later, which GPT notes as the fixed version. Connected sources consis...