Command Injection Vulnerability in QuNetSwitch by QNAP
CVE-2026-22897

8.1HIGH

Key Information:

Vendor

QNAP
Status
Qunetswitch
Vendor
CVE Published:
20 March 2026

What is CVE-2026-22897?

A command injection vulnerability has been identified in QuNetSwitch, which can be exploited by remote attackers to execute arbitrary commands on the system. This issue highlights the need for prompt updates to maintain system integrity and security, as the vulnerability has been addressed in version 2.0.4.0415 and subsequent releases.

Affected Version(s)

QuNetSwitch 2.0.x < 2.0.4.0415

References

https://www.qnap.com/en/security-advisory/qsa-26-11

CVSS V4

Score:
8.1
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

產品安全漏洞獵捕計劃 - YingMuo
.