A SQL injection flaw exists in Video Station's class_videos.php getSmartVideosByOffset function that allows a remote attacker with an authenticated user account to supply crafted input that is not properly sanitized, causing unintended SQL statements to be executed against the database. This vulnerability can result in the execution of arbitrary code or system commands, giving the attacker full control over the affected device and compromising confidentiality, integrity, and availability. The weakness is classified as CWE‑89.

The flaw is present in QNAP Systems Inc.'s Video Station application. Any installation running a version earlier than 5.8.8 is vulnerable. The vendor has released a fix starting with Video Station 5.8.8, and users must upgrade to this or later version to remediate the issue.

The CVSS score is 7.1, indicating a serious impact. The EPSS score of less than 1% suggests a low probability of exploitation at the current time, and the vulnerability is not listed in the CISA KEV catalog. Still, an attacker must first authenticate with a valid user account, then trigger the vulnerable endpoint; if successful, the flaw could be used to run arbitrary code. The attack vector is likely remote, via over-the-network web interfaces where authenticated users can submit parameters.