QNAP Qvr vulnerabilities

10 CVEs affecting QNAP Qvr, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2025-52856, published 2025-08-29.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2021-34352, published 2021-10-01. Critical severity, CVSS 9.8. EPSS: 1.5% chance of exploitation in the next 30 days. A command injection vulnerability has been reported to affect QNAP device running QVR. If exploited, this vulnerability could allow remote attackers to run arbitrary commands. We have already fixed…
CVE-2021-38685, published 2021-11-26. Critical severity, CVSS 9.8. EPSS: 1.5% chance of exploitation in the next 30 days. A command injection vulnerability has been reported to affect QNAP device, VioStor. If exploited, this vulnerability allows remote attackers to run arbitrary commands. We have already fixed this…
CVE-2021-34351, published 2021-09-27. Critical severity, CVSS 9.8. EPSS: 1.5% chance of exploitation in the next 30 days. A command injection vulnerability has been reported to affect QNAP device running QVR. If exploited, this vulnerability could allow remote attackers to run arbitrary commands. We have already fixed…
CVE-2021-34348, published 2021-09-27. Critical severity, CVSS 9.8. EPSS: 1.5% chance of exploitation in the next 30 days. A command injection vulnerability has been reported to affect QNAP device running QVR. If exploited, this vulnerability could allow remote attackers to run arbitrary commands. We have already fixed…
CVE-2021-34349, published 2021-09-27. High severity, CVSS 7.2. EPSS: 1.5% chance of exploitation in the next 30 days. A command injection vulnerability has been reported to affect QNAP device running QVR. If exploited, this vulnerability could allow remote attackers to run arbitrary commands. We have already fixed…
CVE-2022-27588, published 2022-05-05. Critical severity, CVSS 9.8. EPSS: 1.4% chance of exploitation in the next 30 days. We have already fixed this vulnerability in the following versions of QVR: QVR 5.1.6 build 20220401 and later
CVE-2023-23355, published 2023-03-29. High severity, CVSS 7.2. EPSS: 1.2% chance of exploitation in the next 30 days. An OS command injection vulnerability has been reported to affect QNAP operating systems. If exploited, the vulnerability possibly allows remote authenticated administrators to execute commands via…
CVE-2021-38686, published 2021-11-26. High severity, CVSS 8.8. EPSS: 1% chance of exploitation in the next 30 days. An improper authentication vulnerability has been reported to affect QNAP device, VioStor. If exploited, this vulnerability allows attackers to compromise the security of the system. We have already…
CVE-2022-27597, published 2023-03-29. Low severity, CVSS 2.7. EPSS: 0.7% chance of exploitation in the next 30 days. A vulnerability has been reported to affect QNAP operating systems. If exploited, the out-of-bounds read vulnerability allows remote authenticated administrators to get secret values. The…
CVE-2025-52856, published 2025-08-29. Critical severity, CVSS 9.8. EPSS: 0.7% chance of exploitation in the next 30 days. An improper authentication vulnerability has been reported to affect VioStor. If a remote attacker, they can then exploit the vulnerability to compromise the security of the system. We have already…