Command Injection Flaw in QuNetSwitch by QNAP
CVE-2026-22901

6.3MEDIUM

Key Information:

Vendor

QNAP
Status
Qunetswitch
Vendor
CVE Published:
20 March 2026

What is CVE-2026-22901?

A command injection vulnerability has been identified in QuNetSwitch that allows remote attackers with user account access to execute arbitrary commands on the affected systems. This security flaw can lead to unauthorized control and manipulation of system functionalities. It is critical for users to upgrade to QuNetSwitch version 2.0.5.0906 or later to mitigate this risk.

Affected Version(s)

QuNetSwitch 2.0.x < 2.0.5.0906

References

https://www.qnap.com/en/security-advisory/qsa-26-11

CVSS V4

Score:
6.3
Severity:
MEDIUM
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

產品安全漏洞獵捕計劃 - YingMuo
.