CVE-2023-50360 is a High severity (CVSS 8.8) SQL injection flaw in QNAP Video Station. Authenticated users could inject malicious code over the network. QNAP says it fixed the issue in Video Station 5.8.1, dated 26 February 2024, and later versions. Update the app on every QNAP device that runs it.
What's affected
Product: QNAP Video Station, an app that runs on QNAP NAS devices. Fixed: Video Station 5.8.1 (2024/02/26) and later, per QNAP advisory QSA-24-24 as quoted in the NVD record. The record lists no affected version range. NVD published the record on 6 September 2024.
The QNAP advisory page is built with scripts and returned no readable text when I fetched it, so the affected and fixed builds below come from the NVD record, which quotes the advisory.
Severity: the record scores it 8.8 High with vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. I have no separate vendor score to compare it with. The vector says the attacker needs a low privilege account and no user interaction.
How to check if you're exposed
Video Station is an app, so you can check it from the NAS. Open App Center in the QTS web interface, find Video Station in the installed list, and read its version. Compare it with 5.8.1.
If the app is not installed, you are not exposed to this issue. If it is installed but nobody uses it, that is a good reason to remove it.
Also check which accounts exist on the NAS and who can log in over the network, since the attacker needs a low privilege account. Keep the NAS off the public internet where possible.
A NAS app is a vendor product, so it will not appear in a dependency scan. Add it to your inventory with the version.
What to do now
- Open App Center on each QNAP device and update Video Station to 5.8.1 or later.
- If you do not use Video Station, uninstall it.
- Remove unused user accounts and enforce strong passwords on the NAS.
- Use a VPN for remote access instead of forwarding ports, and turn off UPnP on the router.
- Record the Video Station version in your inventory.
Why it matters
The weakness is CWE-89, SQL injection. The app builds a database query that includes input from a user without separating the data from the query structure. If the input is treated as part of the command, a caller can change what the query does. QNAP's text says a logged in user could inject malicious code over the network.
SQL injection can expose, change or delete whatever the app's database holds, which is why the vector shows high impact on all three of confidentiality, integrity and availability. The standard fix is parameterized queries, which keep data apart from commands.
KEV is false and the record does not claim exploitation. The privilege requirement lowers the odds somewhat, but NAS accounts are frequently shared among family or staff. Update, and review accounts. The free scan at gold.safeguard.sh/scan covers your own repositories, and the Gold directory lists this CVE and its weakness class.
Quick check
Which version fixes it?
Video Station 5.8.1, dated 26 February 2024, and later versions, according to the QNAP advisory text in the NVD record.
Do I need to be logged in to exploit it?
QNAP says authenticated users, and the vector shows low privileges required.
Sources
Last reviewed: 19 October 2026.
