CVE-2023-47222: Critical Info Exposure in QNAP Media Streaming Add-on

CVE-2023-47222 is a critical flaw in the QNAP Media Streaming add-on, scored 9.6, described as an exposure of sensitive information reachable over a network. QNAP fixed it in Media Streaming add-on 500.1.1.5, dated 22 January 2024. Update the add-on and restrict who can reach the NAS.

What's affected

The record quotes QNAP: an exposure of sensitive information vulnerability has been reported to affect the Media Streaming add-on, and if exploited it could allow users to compromise the security of the system via a network. QNAP says the fix is in Media Streaming add-on 500.1.1.5 (2024/01/22) and later.

The record does not give a lower bound for affected versions, so assume any release before 500.1.1.5 is affected. I could not read QNAP's advisory, QSA-24-15, so I cannot add model or platform details.

Note the dates. QNAP's fix is dated 22 January 2024, while the NVD record was published on 26 April 2024. A device updated in January is already covered.

The record gives three weakness tags, path traversal, information exposure and improper authentication, and a vector with a network path, no privileges, user interaction and a changed scope. That combination explains the 9.6 score.

The NVD record was published on 2024-04-26, scores 9.6 (Critical), and carries the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H. Weakness class: CWE-22, CWE-200, CWE-287.

How to check if you're exposed

Check the add-on version on each NAS.

1. Sign in to QTS or QuTS hero as an administrator.
2. Open the App Center and look at the installed apps for Media Streaming add-on.
3. Compare its version with 500.1.1.5.

Then check whether the media streaming service is reachable from outside your network. If you do not use the feature, uninstall the add-on and the exposure goes away.

What to do now

1. Update Media Streaming add-on to 500.1.1.5 or later in the App Center.
2. Remove the add-on if you do not use media streaming.
3. Keep the NAS off the internet, or place it behind a VPN, and review port forwarding rules.
4. Update the NAS firmware as well, since other fixes may apply.
5. Review the QNAP advisory for model specific notes.

Why it matters

The record lists three weaknesses: path traversal, CWE-22, exposure of sensitive information, CWE-200, and improper authentication, CWE-287. Together they suggest that a service meant for media sharing can be reached in ways that skip checks and return data it should protect.

NAS devices are a rich target, since they hold backups, documents and credentials. A critical score on an add-on that serves files over a network is a reason to update promptly. The record's KEV flag is false, so this CVE is not on the CISA Known Exploited Vulnerabilities list.

Optional add-ons are easy to forget. Review which ones you actually use and remove the rest.

Try it yourself

Click through it at your own pace, or open it full screen.

Quick check

Sources

• QNAP advisory QSA-24-15 (listed in the record, not readable in my fetch)

Last reviewed: 19 October 2026.