QNAP sMedio DTCP MOVE: Missing authentication allows remote system access
Summary
QNAP sMedio DTCP MOVE, a NAS add-on for copying and streaming recorded TV programmes, lacks authentication for a critical function. A remote attacker without credentials or user interaction may gain access to the system. The CNA rates the impact as high for confidentiality, integrity and availability, and CISA SSVC rates the vulnerability as automatable with total technical impact.
Affected
- QNAP sMedio DTCP MOVE 1.4.x versions below 1.4.5 (CNA record)
- VulDB describes the range as up to 1.4.4
- Unknown: versions before 1.4.x
Fixed in
- Upgrade to sMedio DTCP MOVE 1.4.5 or later
Workaround
- None documented by the vendor.
- Uninstall the app if it is not needed.
- Restrict network access to the NAS; this is general hardening, not a vendor workaround.
Exploitation
- CISA KEV: not listed
- CISA SSVC: exploitation none, automatable yes, technical impact total
- EPSS: 0.00534 (very low predicted exploitation probability)
- VulDB labels the entry "0-Day"; its meaning for exploit maturity is unconfirmed
- No public proof of concept or in-the-wild exploitation found; this does not rule them out
Our recommendation
- Inventory QNAP NAS units and check whether sMedio DTCP MOVE is installed and which version it runs.
- Upgrade to 1.4.5 or later, or uninstall the app if unused.
- Do not expose the NAS management or app ports to the internet; check port forwarding and router settings.
- Verify the product lifecycle with QNAP; if discontinued, plan a replacement.
- Review logs for unexpected access to the app since 15 October 2026.
- Verify the fixed version on the QNAP advisory page before communicating it to customers.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- QNAP app release notes (vendor advisory) www.qnap.com
- VulDB entry 420574 vuldb.com
- Vulners CVE record vulners.com
- OpenCVE CVE record app.opencve.io
- Strix CVE record www.strix.ai
- EUVD-2026-101974 (EPSS) vulners.com
- QNAP sMedio DTCP MOVE product page www.qnap.com
- QNAP DTCP Move tutorial (2016, possibly outdated) download.qnap.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 01:42.
Original description (NVD)
A missing authentication for critical function vulnerability has been reported to affect sMedio DTCP MOVE. If exploited, the vulnerability could allow remote attackers to gain access to the system. We have already fixed the vulnerability in the following version: sMedio DTCP MOVE 1.4.5 and later
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.