CVE-2023-41288 is a high severity (CVSS 8.8) OS command injection flaw in Video Station, a QNAP app. QNAP says it is fixed in Video Station 5.7.2 (2023/11/23) and later. Update the app from the QNAP App Center, or remove it if you do not need it.
What's affected
QNAP lists the fix in advisory QSA-23-55. The record says the flaw could allow users to execute commands via a network and that it is fixed in Video Station 5.7.2 (2023/11/23) and later. Earlier versions are therefore affected.
QNAP's site blocked our automated request, so the version information comes from the NVD record. The same advisory also covers CVE-2023-41287, a SQL injection in Video Station.
The record scores the flaw 8.8 (High) with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. It can be reached over the network, the attack complexity is low, it requires no privileges, and it needs a user to take part (for example by opening or visiting something). The impact on confidentiality is high, on integrity high and on availability high. The weakness class is CWE-78 (OS command injection). The record does not mark this CVE as being in the CISA Known Exploited Vulnerabilities catalog, and nothing we read says it is exploited in the wild.
How to check if you're exposed
Open the App Center on the QNAP device and read the installed Video Station version. Anything older than 5.7.2 needs the update. If nobody uses the app, uninstall it.
The vector needs no privileges but does need a user to take part. Think about who has access to Video Station pages and whether the device is reachable from the internet.
What to do now
- Update Video Station to 5.7.2 (2023/11/23) or later.
- Uninstall Video Station if it is not in use.
- Read QNAP advisory QSA-23-55 for further steps.
- Put the device behind a VPN or an allow list, and review the apps installed on it.
Why it matters
The weakness is CWE-78, OS command injection. Input is passed to a system command without enough checking, so a caller can change what runs on the device. The vector shows high impact on confidentiality, integrity and availability, with no privileges required.
That combination is why this scores 8.8 where the sibling SQL injection scores 4.3. A NAS holds backups and shared files, so command execution on it is a serious outcome even when a click is needed.
Quick check
Does the attacker need an account?
The vector says no privileges are required, but a user must take part in the attack.
Which version is fixed?
Video Station 5.7.2 (2023/11/23) and later, per QNAP.
Sources
- QNAP advisory QSA-23-55 (linked from the NVD record; access was blocked when we reviewed it)
- CVE-2023-41288 on Gold
Last reviewed: 19 October 2026.
