Vulnerability Report

CVE-2024-14025

Title: SQL Injection in QNAP Video Station

SQLi

Proof Of Concept

No public PoC currently indexed for CVE-2024-14025.

CWE Category CWE-89

Published Date Mar 11, 2026

Modified Date Mar 13, 2026

Exploit Status Not Found

Score 0.1 CVSS v4.0

Exploit Probability (EPSS)

0.14%

Vulnerability Summary

CVE-2024-14025: An SQL injection vulnerability has been reported to affect Video Station. If an attacker gains local network access who have also gained an administrator account, they can then exploit the vulnerability to execute unauthorized code or commands. We have already fixed the vulnerability in the following version: Video Station 5.8.2 and later

Impacted Vendors

synology 1

qnap 1

Reference Links

https://www.qnap.com/en/security-advisory/qsa-24-56

CVSS v4.0

Source Entity [email protected]

Severity LOW

0.1

Attack Vector

PHYSICAL

Complexity

LOW

Privileges

N/A

Interaction

NONE

Confidentiality

N/A

Integrity

N/A

Availability

N/A

Scope

N/A

RAW VECTOR

CVSS:4.0/AV:P/AC:L/AT:P/PR:H/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CVSS v3.1

Source Entity [email protected]

Severity MEDIUM

6.7

Attack Vector

LOCAL

Complexity

LOW

Privileges

N/A

Interaction

NONE

Confidentiality

N/A

Integrity

N/A

Availability

N/A

Scope

UNCHANGED

RAW VECTOR CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Associated Attack Patterns (CAPEC)

Total: Patterns