by Kastro
Paper/Archive/CVE-2026-34006

CVE-2026-34006

QNAP Systems Inc. sMedio DTCP MOVE — Pre-Authentication Multiple Critical Vulnerabilities in QNAP sMedioDTCPServer

EPSS 0.4%CVSS 9.3
critical.is priorityof 100
35
CVSS 9.3 (CNA)9.3 / 10 × 3027.9Not in CISA KEV+300.0EPSS percentile 33.7.337 × 206.7No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

A missing authentication for critical function vulnerability has been reported to affect sMedio DTCP MOVE. If exploited, the vulnerability could allow remote attackers to gain access to the system. We have already fixed the vulnerability in the following version: sMedio DTCP MOVE 1.4.5 and later

Affected

ProductAffectedFixed inSource
sMedio DTCP MOVE1.4.x – < 1.4.51.4.5CNA

Scores by source

qnap (CNA)9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refqnap.com/en/app-release-notes?keyword=sMedio&app=sMedioDTCPServer&product-line=nas