Description
An OS command injection vulnerability has been reported to affect HybridDesk Station. If exploited, the vulnerability could allow remote attackers to execute arbitrary commands.

We have already fixed the vulnerability in the following version:
HybridDesk Station 4.2.23 and later
HybridDesk Station 4.3.4 and later
Published: 2026-10-15
Score: 9.3 Critical
EPSS: 1.1% Low
KEV: No
Impact: Remote Code Execution
Action: Immediate Patch
AI Analysis

Impact

The vulnerability is a pre‑authentication OS command injection that allows an attacker to execute arbitrary system commands on HybridDesk Station before authentication. The flaw, identified as CWE‑78, can lead to full compromise of the host, affecting confidentiality, integrity, and availability of the device and any data it manages.

Affected Systems

QNAP Systems Inc. HybridDesk Station devices running firmware versions earlier than 4.2.23 in the 4.2 series or earlier than 4.3.4 in the 4.3 series are affected.

Risk and Exploitability

The CVSS score of 9.3 indicates high severity, while the EPSS score of 1% shows a low but present probability of exploitation. The vulnerability is not listed in CISA KEV. The likely attack vector is remote, targeting network‑exposed interfaces of HybridDesk Station before authentication is required, enabling an attacker to run arbitrary commands.

Generated by OpenCVE AI on October 16, 2026 at 22:08 UTC.

Remediation

Vendor Solution

We have already fixed the vulnerability in the following version: HybridDesk Station 4.2.23 and later HybridDesk Station 4.3.4 and later

OpenCVE Recommended Actions

  • Upgrade HybridDesk Station to at least version 4.2.23 on the 4.2 series or 4.3.4 on the 4.3 series, which contain the patch for this vulnerability.
  • If an upgrade cannot be performed immediately, restrict remote access to the device by disabling the web management interface or limiting it to trusted IP addresses until the patch is applied.
  • Continuously monitor system logs for signs of unauthorized command execution or abnormal activity that might indicate exploitation attempts.

Generated by OpenCVE AI on October 16, 2026 at 22:08 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 21 Oct 2026 20:45:00 +0000

Type Values Removed Values Added
First Time appeared Qnap Systems
Qnap Systems hybriddesk Station
Vendors & Products Qnap Systems
Qnap Systems hybriddesk Station

Thu, 15 Oct 2026 14:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Thu, 15 Oct 2026 13:30:00 +0000

Type Values Removed Values Added
Description An OS command injection vulnerability has been reported to affect HybridDesk Station. If exploited, the vulnerability could allow remote attackers to execute arbitrary commands. We have already fixed the vulnerability in the following version: HybridDesk Station 4.2.23 and later HybridDesk Station 4.3.4 and later
Title Pre-Authentication Command Injection
Weaknesses CWE-78
References
Metrics cvssV4_0

{'score': 9.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Qnap Systems Hybriddesk Station
cve-icon MITRE

Status: PUBLISHED

Assigner: qnap

Published:

Updated: 2026-10-15T13:21:25.935Z

Reserved: 2026-05-20T07:19:15.800Z

Link: CVE-2026-47786

cve-icon Vulnrichment

Updated: 2026-10-15T13:21:22.875Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-15T10:17:14.720

Modified: 2026-10-15T16:32:39.893

Link: CVE-2026-47786

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-21T20:23:20Z

Weaknesses
  • CWE-78

    Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')