by Kastro
Paper/Archive/CVE-2026-22900

CVE-2026-22900

QNAP Systems Inc. QuNetSwitch — QuNetSwitch

EPSS 0.3%CVSS 9.8
critical.is priorityof 100
35
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 26.5.265 × 205.3No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

A use of hard-coded credentials vulnerability has been reported to affect QuNetSwitch. The remote attackers can then exploit the vulnerability to gain unauthorized access. We have already fixed the vulnerability in the following version: QuNetSwitch 2.0.5.0906 and later

Affected

ProductAffectedFixed inSource
QuNetSwitch2.0.x – < 2.0.5.09062.0.5.0906CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
qnap (CNA)6.8CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:U
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: partial

References

refqnap.com/en/security-advisory/qsa-26-11