QNAP Qunetswitch vulnerabilities

5 CVEs affecting QNAP Qunetswitch, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-22902, published 2026-03-20.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2021-28813, published 2021-09-10. High severity, CVSS 7.5. EPSS: 1.1% chance of exploitation in the next 30 days. A vulnerability involving insecure storage of sensitive information has been reported to affect QSW-M2116P-2T2S and QNAP switches running QuNetSwitch. If exploited, this vulnerability allows remote…
CVE-2026-22897, published 2026-03-20. Critical severity, CVSS 9.8. EPSS: 1.1% chance of exploitation in the next 30 days. A command injection vulnerability has been reported to affect QuNetSwitch. The remote attackers can then exploit the vulnerability to execute arbitrary commands. We have already fixed the…
CVE-2026-22901, published 2026-03-20. Critical severity, CVSS 9.8. EPSS: 1% chance of exploitation in the next 30 days. A command injection vulnerability has been reported to affect QuNetSwitch. If a remote attacker gains a user account, they can then exploit the vulnerability to execute arbitrary commands. We have…
CVE-2026-22902, published 2026-03-20. Medium severity, CVSS 6.7. EPSS: 0.5% chance of exploitation in the next 30 days. A command injection vulnerability has been reported to affect QuNetSwitch. If a local attacker gains an administrator account, they can then exploit the vulnerability to execute arbitrary…
CVE-2026-22900, published 2026-03-20. Critical severity, CVSS 9.8. EPSS: 0.3% chance of exploitation in the next 30 days. A use of hard-coded credentials vulnerability has been reported to affect QuNetSwitch. The remote attackers can then exploit the vulnerability to gain unauthorized access. We have already fixed the…