CVE-2025-58463lowCWE-23

CVE-2025-58463: falha de baixa gravidade em QNAP Systems Inc. Download Station

Download Station

Publicada em

Seguir esta CVE+ Monitorar Download Station

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

8Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 2.3epss 0.5%
A relative path traversal vulnerability has been reported to affect Download Station. If a remote attacker gains an administrator account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed the vulnerability in the following versions: Download Station 5.10.0.305 ( 2025/09/16 ) and later Download Station 5.10.0.304 ( 2025/09/08 ) and later
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:U
Produtos afetados
QNAP Systems Inc. · Download Station
CVEs relacionadas — QNAP Systems Inc. Download Station

No mesmo produto, das mais perigosas para as menos.

CVE-2026-39993HIGHPath Traversal to Root RCE in QNAP Download Station via Addon/Search addon ParameterEPSS 0.4%CVE-2026-39989MEDIUMSSRF in QNAP Download StationEPSS 0.3%CVE-2024-38640HIGHDownload StationEPSS 0.2%CVE-2025-58465LOWDownload StationEPSS 0.2%CVE-2026-34014HIGHds-move-files.sh is writable and executed as rootEPSS 0.1%