CVE-2024-38640highCWE-79

CVE-2024-38640: falha de alta gravidade em QNAP Systems Inc. Download Station

Download Station

Publicada em

Seguir esta CVE+ Monitorar Download Station

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 7epss 0.2%
A cross-site scripting (XSS) vulnerability has been reported to affect Download Station. If exploited, the vulnerability could allow authenticated users to inject malicious code via a network. We have already fixed the vulnerability in the following version: Download Station 5.8.6.283 ( 2024/06/21 ) and later
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N
Produtos afetados
QNAP Systems Inc. · Download Station
CVEs relacionadas — QNAP Systems Inc. Download Station

No mesmo produto, das mais perigosas para as menos.

CVE-2025-58463LOWDownload StationEPSS 0.5%CVE-2026-39993HIGHPath Traversal to Root RCE in QNAP Download Station via Addon/Search addon ParameterEPSS 0.4%CVE-2026-39989MEDIUMSSRF in QNAP Download StationEPSS 0.3%CVE-2025-58465LOWDownload StationEPSS 0.2%CVE-2026-34014HIGHds-move-files.sh is writable and executed as rootEPSS 0.1%