Description
A missing authentication for critical function vulnerability has been reported to affect HybridDesk Station. If exploited, the vulnerability could allow remote attackers to gain access to the system.

We have already fixed the vulnerability in the following version:
HybridDesk Station 4.2.22 and later
Published: 2026-10-15
Score: 8.9 High
EPSS: < 1% Very Low
KEV: No
Impact: Unauthorized Remote Access
Action: Immediate Update
AI Analysis

Impact

This vulnerability is a missing authentication flaw that allows remote attackers to invoke a critical function without providing credentials. The flaw permits unauthenticated remote input injection, allowing an attacker to access system functions directly. The weakness is categorized as missing authentication (CWE-306).

Affected Systems

QNAP Systems Inc. HybridDesk Station is affected. All versions of HybridDesk Station released prior to 4.2.22 are vulnerable. The fix is available in HybridDesk Station 4.2.22 and later releases.

Risk and Exploitability

The CVSS base score of 8.9 marks this as a high‑severity vulnerability. The EPSS score is less than 1%, indicating a low probability that the flaw has been exploited in the wild. It is not listed in the CISA KEV catalog. The likely attack vector is remote over the network, as the flaw permits unauthenticated requests to a critical function. The absence of authentication mechanisms means an attacker could reach the affected component from any network that can contact the device, resulting in unauthorized system access.

Generated by OpenCVE AI on October 16, 2026 at 22:09 UTC.

Remediation

Vendor Solution

We have already fixed the vulnerability in the following version: HybridDesk Station 4.2.22 and later

OpenCVE Recommended Actions

  • Upgrade to HybridDesk Station 4.2.22 or a later version, which contains the vendor‑patched fix.
  • If an immediate upgrade is not feasible, restrict network access to the device using firewall rules or VPN so that only trusted hosts can reach the vulnerable service.
  • Continuously monitor device logs for unexpected or unauthenticated access attempts and investigate any suspicious activity.

Generated by OpenCVE AI on October 16, 2026 at 22:09 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 23 Oct 2026 00:45:00 +0000

Type Values Removed Values Added
First Time appeared Qnap Systems
Qnap Systems hybriddesk Station
Vendors & Products Qnap Systems
Qnap Systems hybriddesk Station

Thu, 15 Oct 2026 14:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Thu, 15 Oct 2026 13:30:00 +0000

Type Values Removed Values Added
Description A missing authentication for critical function vulnerability has been reported to affect HybridDesk Station. If exploited, the vulnerability could allow remote attackers to gain access to the system. We have already fixed the vulnerability in the following version: HybridDesk Station 4.2.22 and later
Title Unauthenticated Remote Input Injection in QNAP HD Station's remotepad
Weaknesses CWE-306
References
Metrics cvssV4_0

{'score': 8.9, 'vector': 'CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H'}

Subscriptions

Qnap Systems Hybriddesk Station
cve-icon MITRE

Status: PUBLISHED

Assigner: qnap

Published:

Updated: 2026-10-15T13:31:41.953Z

Reserved: 2026-04-08T02:30:26.921Z

Link: CVE-2026-39997

cve-icon Vulnrichment

Updated: 2026-10-15T13:31:38.624Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-15T10:17:14.197

Modified: 2026-10-15T16:32:39.893

Link: CVE-2026-39997

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-22T21:19:51Z

Weaknesses
  • CWE-306

    Missing Authentication for Critical Function