CVSS 4.0
Вероятност да бъде експлоатирана в следващите 30 дни (EPSS)
Атакува се
Време до експлоатация
Атакува се по мрежата, без особени условия, с администраторски права и след действие от потребителя.
- Експлоатация: няма данни за експлоатация
- Атаката не може да се автоматизира
Описание
Оригинално описание
A cross-site scripting (XSS) vulnerability has been reported to affect Network & Virtual Switch. If a remote attacker gains an administrator account, they can then exploit the vulnerability to inject malicious code. We have already fixed the vulnerability in the following version: Network & Virtual Switch in QTS 5.1.8.2823 build 20240712 and later Network & Virtual Switch in QTS 5.2.1.2930 build 20241025 and later Network & Virtual Switch in QuTS cloud c5.2.4.3041 build 20250211 and later Network & Virtual Switch in QuTS hero h5.1.8.2823 build 20240712 and later Network & Virtual Switch in QuTS hero h5.2.1.2929 build 20241025 and later
Засегнати продукти
- QNAP Systems Inc. Network & Virtual Switch: QTS 5.1.x преди QTS 5.1.8.2823 build 20240712; QTS 5.2.x преди QTS 5.2.1.2930 build 20241025; QuTS cloud c5.2.x преди QuTS cloud c5.2.4.3041 build 20250211; QuTS hero h5.1.x преди QuTS hero h5.1.8.2823 build 20240712; QuTS hero h5.2.x преди QuTS hero h5.2.1.2929 build 20241025
Вид слабост
История
- 15 октомври 2026 Публикувано
Първоизточници
- https://www.cve.org/CVERecord?id=CVE-2026-22896
- https://nvd.nist.gov/vuln/detail/CVE-2026-22896
- https://www.qnap.com/en/release-notes/qts/5.1.8.2823/20240712
- https://www.qnap.com/en/release-notes/qts/5.2.1.2930/20241025
- https://www.qnap.com/en/release-notes/qutscloud/c5.2.4.3041/20250211
- https://www.qnap.com/en/release-notes/quts_hero/h5.1.8.2823/20240712
- https://www.qnap.com/en/release-notes/quts_hero/h5.2.1.2929/20241025