CVE-2026-22902

MEDIUM

QuNetSwitch < 2.0.5.0906 - Local Admin OS Command Injection

Title source: manual

Description

A command injection vulnerability has been reported to affect QuNetSwitch. If a local attacker gains an administrator account, they can then exploit the vulnerability to execute arbitrary commands. We have already fixed the vulnerability in the following version: QuNetSwitch 2.0.5.0906 and later

References (1)

Core 1

Core References

https://www.qnap.com/en/security-advisory/qsa-26-11

Scores

CVSS v3 6.7

EPSS 0.0046

EPSS Percentile 36.5%

Attack Vector LOCAL

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact total

Details

CWE

CWE-78

Status published

Products (2)

qnap/qunetswitch < 2.0.5.0906

QNAP Systems Inc./QuNetSwitch 2.0.x - 2.0.5.0906

Published Mar 20, 2026

Tracked Since Mar 20, 2026