QNAP License Center vulnerabilities

6 CVEs affecting QNAP License Center, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2025-62851, published 2026-06-10.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2024-48863, published 2024-12-06. Critical severity, CVSS 9.8. EPSS: 1.1% chance of exploitation in the next 30 days. A command injection vulnerability has been reported to affect License Center. If exploited, the vulnerability could allow remote attackers to execute arbitrary commands. We have already fixed the…
CVE-2025-53597, published 2026-01-02. Medium severity, CVSS 6.5. EPSS: 0.6% chance of exploitation in the next 30 days. A buffer overflow vulnerability has been reported to affect License Center. If a remote attacker gains an administrator account, they can then exploit the vulnerability to modify memory or crash…
CVE-2025-52871, published 2026-01-02. Medium severity, CVSS 6.5. EPSS: 0.6% chance of exploitation in the next 30 days. An out-of-bounds read vulnerability has been reported to affect License Center. If a remote attacker gains a user account, they can then exploit the vulnerability to obtain secret data. We have…
CVE-2024-50406, published 2025-06-06. Medium severity, CVSS 5.4. EPSS: 0.3% chance of exploitation in the next 30 days. A cross-site scripting (XSS) vulnerability has been reported to affect License Center. If exploited, the vulnerability could allow remote attackers who have gained user access to bypass security…
CVE-2025-62851, published 2026-06-10. Medium severity, CVSS 4.4. EPSS: 0.3% chance of exploitation in the next 30 days. A path traversal vulnerability has been reported to affect License Center. If a local attacker gains an administrator account, they can then exploit the vulnerability to read the contents of…
CVE-2025-22483, published 2025-08-29. Medium severity, CVSS 4.8. EPSS: 0.2% chance of exploitation in the next 30 days. A cross-site scripting (XSS) vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the…