QNAP Multimedia Console vulnerabilities

5 CVEs affecting QNAP Multimedia Console, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2023-23369, published 2023-11-03.

More from QNAP.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2023-23369, published 2023-11-03. Critical severity, CVSS 9.8. EPSS: 14.5% chance of exploitation in the next 30 days. An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow users to execute commands via a network. We have…
• CVE-2020-36195, published 2021-04-17. Critical severity, CVSS 9.8. EPSS: 1.8% chance of exploitation in the next 30 days. An SQL injection vulnerability has been reported to affect QNAP NAS running Multimedia Console or the Media Streaming add-on. If exploited, the vulnerability allows remote attackers to obtain…
• CVE-2021-38684, published 2021-11-13. Critical severity, CVSS 9.8. EPSS: 1.3% chance of exploitation in the next 30 days. A stack buffer overflow vulnerability has been reported to affect QNAP NAS running Multimedia Console. If exploited, this vulnerability allows attackers to execute arbitrary code. We have already…
• CVE-2023-23364, published 2023-09-22. Critical severity, CVSS 9.8. EPSS: 0.9% chance of exploitation in the next 30 days. A buffer copy without checking size of input vulnerability has been reported to affect QNAP operating systems. If exploited, the vulnerability possibly allows remote users to execute code via…
• CVE-2020-2493, published 2020-12-10. Medium severity, CVSS 6.1. EPSS: 0.8% chance of exploitation in the next 30 days. This cross-site scripting vulnerability in Multimedia Console allows remote attackers to inject malicious code. QANP have already fixed this vulnerability in Multimedia Console 1.1.5 and later.