QNAP HybridDesk Station: Pre-authentication OS command injection
Summary
QNAP HybridDesk Station, an optional app for QNAP NAS devices that provides HDMI display output and multimedia access, contains an OS command injection vulnerability (CWE-78). A remote attacker can exploit it without authentication and user interaction to execute arbitrary commands on the NAS, with a CVSS 4.0 base score of 9.3 (Critical) from the CNA. Only NAS units with HybridDesk Station installed in an affected version are at risk, and the impact is high if the NAS is reachable from untrusted networks.
Affected
- HybridDesk Station 4.2.x before 4.2.23
- HybridDesk Station 4.3.x before 4.3.4
- Whether earlier branches are affected: Unknown.
Fixed in
- HybridDesk Station 4.2.23 and later
- HybridDesk Station 4.3.4 and later
Workaround
- Unknown. The vendor has published no workaround. Remove HybridDesk Station where it is not needed.
- Keep the NAS administration interface off the internet and behind a VPN.
Exploitation
- CISA KEV: not listed.
- CISA SSVC: exploitation none, automatable yes, technical impact total.
- No confirmed exploitation in the wild in the sources reviewed.
- No verified public proof of concept. EPSS about 0.0107.
Our recommendation
- Check whether HybridDesk Station is installed on any QNAP NAS (App Center or HDMI Display Applications menu).
- Update to 4.2.23, 4.3.4 or later as soon as possible.
- Remove HybridDesk Station on devices where it is not needed.
- Check port forwarding and NAT rules and do not expose the NAS administration interface to the internet.
- Monitor NAS logs for unexpected processes or access attempts.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- QNAP release notes HybridDesk Station www.qnap.com
- CVE List record (Vulners) vulners.com
- VulDB entry 420578 vuldb.com
- Strix CVE record www.strix.ai
- Vulners CVE record vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 01:42.
Original description (NVD)
An OS command injection vulnerability has been reported to affect HybridDesk Station. If exploited, the vulnerability could allow remote attackers to execute arbitrary commands. We have already fixed the vulnerability in the following version: HybridDesk Station 4.2.23 and later HybridDesk Station 4.3.4 and later
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.