The vulnerability is a missing authentication flaw in QNAP sMedio DTCP MOVE that allows a critical function to be accessed prior to any user credential verification. This flaw is identified as CWE‑306. If exploited, an attacker can gain unauthorized access to the DTCP service and potentially control the device, raising a risk of full system compromise.

QNAP Systems Inc. sMedio DTCP MOVE software versions earlier than 1.4.5 are affected. Versions 1.4.5 and later include a fix that restores proper authentication for the critical function.

The CVSS score of 9.3 indicates critical severity, while the EPSS score of less than 1 % suggests that mass exploitation is currently unlikely. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a network‑based request to the DTCP service before authentication is required, enabling an attacker to attempt exploitation from any network location that can reach the service. Successful exploitation would provide remote access to the device.