Description
An authorization bypass through user-controlled key vulnerability has been reported to affect Video Station. If exploited, the vulnerability could allow remote attackers to obtain sensitive data.

We have already fixed the vulnerability in the following version:
Video Station 5.8.8 and later
Published: 2026-10-15
Score: 8.7 High
EPSS: < 1% Very Low
KEV: No
Impact: Unauthorized Media Access
Action: Immediate Patch
AI Analysis

Impact

The vulnerability is an authorization bypass through a user‑controlled key that allows an attacker to obtain sensitive data within Video Station. Exploitation could let a remote individual access media files or other confidential content stored on the device. This weakness is classified as CWE‑639, a missing or incorrect authorization check.

Affected Systems

The affected vendor is QNAP Systems Inc., product Video Station, which runs on QNAP NAS devices. Any installation using a version earlier than Video Station 5.8.8 is vulnerable, as the fix is only available in release 5.8.8 and later.

Risk and Exploitability

The CVSS score of 8.7 denotes high severity, while the EPSS score of less than 1% indicates that the exploitation rate is low at present. The vulnerability is not listed in the CISA KEV catalog, suggesting no known public exploitation. Nonetheless, because the attack vector is likely remote via the Video Station web interface, organizations with publicly exposed devices should consider the risk significant and act promptly.

Generated by OpenCVE AI on October 16, 2026 at 22:09 UTC.

Remediation

Vendor Solution

We have already fixed the vulnerability in the following version: Video Station 5.8.8 and later

OpenCVE Recommended Actions

  • Upgrade Video Station software to version 5.8.8 or later to apply the vendor‑provided fix.
  • Limit or disable public network exposure of the Video Station web interface by configuring firewalls or network segmentation.
  • Monitor device logs for suspicious access attempts and enable alerts on unauthorized access events.

Generated by OpenCVE AI on October 16, 2026 at 22:09 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 16 Oct 2026 17:30:00 +0000

Type Values Removed Values Added
First Time appeared Qnap
Qnap video Station
CPEs cpe:2.3:a:qnap:video_station:*:*:*:*:*:*:*:*
Vendors & Products Qnap
Qnap video Station
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'}

Thu, 15 Oct 2026 15:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 15 Oct 2026 13:30:00 +0000

Type Values Removed Values Added
Description An authorization bypass through user-controlled key vulnerability has been reported to affect Video Station. If exploited, the vulnerability could allow remote attackers to obtain sensitive data. We have already fixed the vulnerability in the following version: Video Station 5.8.8 and later
Title Access Code Forgery in Video Station leading to unauthorized media access
Weaknesses CWE-639
References
Metrics cvssV4_0

{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

Qnap Video Station
cve-icon MITRE

Status: PUBLISHED

Assigner: qnap

Published:

Updated: 2026-10-15T14:13:21.907Z

Reserved: 2026-05-05T07:32:16.697Z

Link: CVE-2026-44084

cve-icon Vulnrichment

Updated: 2026-10-15T14:13:18.530Z

cve-icon NVD

Status : Analyzed

Published: 2026-10-15T10:17:14.587

Modified: 2026-10-16T17:10:32.820

Link: CVE-2026-44084

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-17T17:45:11Z

Weaknesses
  • CWE-639

    Authorization Bypass Through User-Controlled Key