CVE-2023-41287 is a medium severity (CVSS 4.3) SQL injection flaw in Video Station, a QNAP app. QNAP says it is fixed in Video Station 5.7.2 (2023/11/23) and later. Update the app from the QNAP App Center and read advisory QSA-23-55 for the details.
What's affected
QNAP lists the fix in advisory QSA-23-55. The record says: "If exploited, the vulnerability could allow users to inject malicious code via a network," and that it is fixed in Video Station 5.7.2 (2023/11/23) and later. Earlier versions are therefore affected.
QNAP's site blocked our automated request, so the version information comes from the NVD record. The same advisory also covers CVE-2023-41288, an OS command injection in Video Station.
The record scores the flaw 4.3 (Medium) with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N. It can be reached over the network, the attack complexity is low, it requires no privileges, and it needs a user to take part (for example by opening or visiting something). The impact on confidentiality is low, on integrity no and on availability no. The weakness class is CWE-89 (SQL injection). The record does not mark this CVE as being in the CISA Known Exploited Vulnerabilities catalog, and nothing we read says it is exploited in the wild.
How to check if you're exposed
Open the App Center on the QNAP device and look at the installed version of Video Station. Anything older than 5.7.2 should be updated. If you do not use Video Station, uninstall it.
Also check who can reach the device. The vector needs no privileges but does need a user to take part, so shared links and user facing pages matter.
What to do now
- Update Video Station to 5.7.2 (2023/11/23) or later from the App Center.
- Uninstall Video Station if nobody uses it.
- Read QNAP advisory QSA-23-55 for any further steps.
- Keep the device's web interfaces off the public internet where you can.
Why it matters
The weakness is CWE-89, SQL injection. Input reaches a database query without being kept separate from the query itself, so a caller can alter what the query does. The vector shows only a low confidentiality impact, which is why the score is modest.
Media apps on a NAS are often installed once and forgotten. Updating or removing them shrinks the surface of a device that stores a lot of data.
Quick check
Which Video Station version fixes it?
QNAP says 5.7.2 (2023/11/23) and later.
Is there a related command injection?
Yes. CVE-2023-41288, also in advisory QSA-23-55, is an OS command injection in Video Station.
Sources
- QNAP advisory QSA-23-55 (linked from the NVD record; access was blocked when we reviewed it)
- CVE-2023-41287 on Gold
Last reviewed: 19 October 2026.
