Vendor scorecard
CISA lists 11 QNAP vulnerabilities as exploited in the wild, 0 of them added in the last 12 months (flat from 0 in the 12 months before). 9 (82%) are known to be used in ransomware campaigns. Most affected: Photo Station (4), Network Attached Storage (NAS) (4), VioStor NVR (1).
| Product | KEV entries |
|---|---|
| Photo Station | 4 |
| Network Attached Storage (NAS) | 4 |
| VioStor NVR | 1 |
| QTS | 1 |
| QNAP Network-Attached Storage (NAS) | 1 |
| CVE | Vulnerability | Added |
|---|---|---|
| CVE-2023-47565 | QNAP VioStor NVR OS Command Injection VulnerabilityVioStor NVR | |
| CVE-2022-27593 | QNAP Photo Station Externally Controlled Reference VulnerabilityRANSOMWAREPhoto Station | |
| CVE-2019-7195 | QNAP Photo Station Path Traversal VulnerabilityRANSOMWAREPhoto Station | |
| CVE-2019-7194 | QNAP Photo Station Path Traversal VulnerabilityRANSOMWAREPhoto Station | |
| CVE-2019-7193 | QNAP QTS Improper Input Validation VulnerabilityRANSOMWAREQTS | |
| CVE-2019-7192 | QNAP Photo Station Improper Access Control VulnerabilityRANSOMWAREPhoto Station | |
| CVE-2018-19953 | QNAP NAS File Station Cross-Site Scripting VulnerabilityRANSOMWARENetwork Attached Storage (NAS) | |
| CVE-2018-19949 | QNAP NAS File Station Command Injection VulnerabilityRANSOMWARENetwork Attached Storage (NAS) | |
| CVE-2018-19943 | QNAP NAS File Station Cross-Site Scripting VulnerabilityRANSOMWARENetwork Attached Storage (NAS) | |
| CVE-2020-2509 | QNAP Network-Attached Storage (NAS) Command Injection VulnerabilityQNAP Network-Attached Storage (NAS) | |
| CVE-2021-28799 | QNAP NAS Improper Authorization VulnerabilityRANSOMWARENetwork Attached Storage (NAS) |
Get an email when CISA adds the next QNAP CVE.
How to read this: CISA KEV lists vulnerabilities with reliable evidence of exploitation; a vendor with many entries is often one with a large, internet-facing install base, not necessarily worse engineering. "Publication → KEV" is the median number of days between the CVE's publication and its addition to KEV, for entries added in the last 24 months (0 entries); it is an upper bound on how long defenders had, since exploitation usually starts before the listing. Under NIS2 article 21(2)(d), supplier security is part of your risk management; this page is a starting point for that review. Compare vendors on the scorecard index.
We assess supplier security for NIS2 and DORA, from exploited-CVE history and patch response to contract clauses and evidence packs.
Get in touch →