The vulnerability is an OS command injection flaw in QNAP Notes Station 3. An unsanitized X‑Forwarded‑For HTTP header is passed directly to the PHP shell_exec function when a fallback IP‑validation routine is triggered. This omission allows an attacker to inject shell commands, leading to remote code execution. The weakness is identified as CWE‑78, which underlies arbitrary command execution through improper input handling.

Affected systems are QNAP Systems Inc.’s Notes Station 3 products. The flaw exists in all releases prior to firmware 3.9.11. Users running any earlier version of Notes Station 3 face the risk, while versions 3.9.11 and newer contain the fix deployed by QNAP.

The CVSS score of 6.9 reflects a moderate severity exploit, and the EPSS score of 1% indicates a low but non‑zero likelihood of exploitation in the wild. Although the vulnerability is not catalogued in CISA’s KEV, the attack path is straightforward: a malicious actor crafts an X‑Forwarded‑For header containing shell code and sends it to the web interface, bypassing normal IP validation. The impact is full remote code execution with no prerequisite authentication, making patching a priority.