VulnerabilityModified
CVE-2021-44055
An missing authorization vulnerability has been reported to affect QNAP device running Video Station.
CRITICAL 9.8EPSS 1.04%
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (1.04%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
An missing authorization vulnerability has been reported to affect QNAP device running Video Station. If exploited, this vulnerability allows remote attackers to access data or perform actions that they should not be allowed to perform. We have already fixed this vulnerability in the following versions of Video Station: Video Station 5.5.9 ( 2022/02/16 ) and later
- CVSS 3.1
- 9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 1.04% probability · 62th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-862
- Affected
- qnap/video station
- Source
- security@qnapsecurity.com.tw
References
- https://www.qnap.com/en/security-advisory/qsa-22-14Vendor Advisory
- https://www.qnap.com/en/security-advisory/qsa-22-14Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.