SQL Injection Vulnerability in Multimedia Console and the Media Streaming Add-On

published 2021-04-17 5 y ago modified 2026-06-17 4 mo ago also EUVD-2020-23759

cvss: 9.8; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 1.8%; EPSS 1.8% chance of exploitation in 30 days, percentile 78%
public exploits: 0; none known

An SQL injection vulnerability has been reported to affect QNAP NAS running Multimedia Console or the Media Streaming add-on. If exploited, the vulnerability allows remote attackers to obtain application information. QNAP has already fixed this vulnerability in the following versions of Multimedia Console and the Media Streaming add-on. QTS 4.3.3: Media Streaming add-on 430.1.8.10 and later QTS 4.3.6: Media Streaming add-on 430.1.8.8 and later QTS 4.4.x and later: Multimedia Console 1.3.4 and later We have also fixed this vulnerability in the following versions of QTS 4.3.3 and QTS 4.3.6, respectively: QTS 4.3.3.1624 Build 20210416 or later QTS 4.3.6.1620 Build 20210322 or later

Patch / fix

fixed in 3

QNAP Systems Inc. QTS 4.3.3.1624 Build 20210416, 4.3.6.1620 Build 20210322
QNAP Systems Inc. Media Streaming add-on 430.1.8.8, 430.1.8.10
QNAP Systems Inc. Multimedia Console 1.3.4

Exploit prediction

1.83% chance of exploitation in the next 30 days, higher than 78% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	3.1	9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD	3.1	9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD	2.0	7.5	AV:N/AC:L/Au:N/C:P/I:P/A:P

Affected products

QNAP Systems Inc. QTS
QNAP Systems Inc. Media Streaming add-on
QNAP Systems Inc. Multimedia Console

Classification

Weakness

CWE-20 Improper Input Validation
CWE-89 Improper Neutralization of Special Elements used in an SQL Command
CWE-943 Improper Neutralization of Special Elements in Data Query Logic

References

qnap.com /en/security-advisory/qsa-21-11
vendor-advisory

Sources

CVE List CVE-2020-36195
NVD CVE-2020-36195

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary