CVE-2021-44055

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

An missing authorization vulnerability has been reported to affect QNAP device running Video Station. If exploited, this vulnerability allows remote attackers to access data or perform actions that they should not be allowed to perform. We have already fixed this vulnerability in the following versions of Video Station: Video Station 5.5.9 ( 2022/02/16 ) and later

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-862

Affected software

Vendor	Product	Versions
QNAP Systems Inc.	Video Station	>= unspecified, < 5.5.9 ( 2022/02/16 )

References

https://www.qnap.com/en/security-advisory/qsa-22-14Vendor Advisory
https://www.qnap.com/en/security-advisory/qsa-22-14Vendor Advisory

Timeline

Published: May 5, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-440569.8An improper authentication vulnerability has been reported to affect QNAP device running Video Station. If exploited, this vulnerability all CVE-2021-440579.8An improper authentication vulnerability has been reported to affect QNAP device running Photo Station. If exploited, this vulnerability all CVE-2021-44067.2An authenticated attacker is able to create alerts that trigger a stored XSS attack. POC * go to the alert manager * open the ITS CVE-2021-44074.3The Custom Banners plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.2.2 This is due to m CVE-2021-440764.8An issue was discovered in CrushFTP 9. The creation of a new user through the /WebInterface/UserManager/ interface allows an attacker, with CVE-2021-440779.8Zoho ManageEngine ServiceDesk Plus before 11306, ServiceDesk Plus MSP before 10530, and SupportCenter Plus before 11014 are vulnerable to un CVE-2021-440788.1An issue was discovered in split_region in uc.c in Unicorn Engine before 2.0.0-rc5. It allows local attackers to escape the sandbox. An atta CVE-2021-440799.8In the wazuh-slack active response script in Wazuh 4.2.x before 4.2.5, untrusted user agents are passed to a curl command line, potentially CVE-2021-44084.3The DW Question & Answer plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.5.8. This is d CVE-2021-440807.2A Command Injection vulnerability in httpd web server (setup.cgi) in SerComm h500s, FW: lowi-h500s-v3.4.22 allows logged in administrators t CVE-2021-440817.5A buffer overflow vulnerability exists in the AMF of open5gs 2.1.4. When the length of MSIN in Supi exceeds 24 characters, it leads to AMF d CVE-2021-440828.3textpattern 4.8.7 is vulnerable to Cross Site Scripting (XSS) via /textpattern/index.php,Body. A remote and unauthenticated attacker can use