A stored cross‑site scripting vulnerability exists in the Network & Virtual Switch application. When a remote attacker obtains an administrator account, they can inject malicious script into the interface name field. The script is then stored and executed whenever the affected page is viewed, allowing the attacker to run arbitrary JavaScript in the context of an authenticated admin user. This can lead to credential theft, session hijacking, or further compromise of the device. The weakness is identified as a classic input validation flaw related to improper output encoding (CWE‑79).

The vulnerability affects QNAP Systems Inc. Network & Virtual Switch across QTS 5.1.8.2823 (build 20240712) and newer, QTS 5.2.1.2930 (build 20241025) and newer, QuTS cloud c5.2.4.3041 (build 20250211) and newer, QuTS hero h5.1.8.2823 (build 20240712) and newer, and QuTS hero h5.2.1.2929 (build 20241025) and newer.

The CVSS score of 6.2 labels this a medium‑severity flaw, reflecting moderate impact under normal conditions. The EPSS score of less than 1% indicates a very low probability of exploitation at this time, and the vulnerability is not listed in CISA’s KEV catalog. Exploitation requires an existing administrator session, so the attack vector is limited to users who have successfully authenticated to the management interface. Because the flaw is stored and not triggered by arbitrary input from unauthenticated users, the circumstances for exploitation are relatively restrictive.