CVE-2015-7261: QNAP Iartist Lite

Critical severity, CVSS 9.8. EPSS: 1.6% chance of exploitation in the next 30 days.

The FTP service in QNAP iArtist Lite before 1.4.54, as distributed with QNAP Signage Station before 2.0.1, has hardcoded credentials, which makes it easier for remote attackers to obtain access via a session on TCP port 21.

Affected products

• QNAP Iartist Lite: up to and including 1.4.53.1
• QNAP Signage Station: up to and including 2.0

Published 2016-02-27. Last modified 2026-06-17.