EIP-2026-101935

PRE-CVE

QNAP Turbo NAS 3.6.1 Build 0302T - Multiple Vulnerabilities

Title source: legacy
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for EIP-2026-101935. PoCs published by Sense of Security.

AI-analyzed exploit summary The advisory describes a command injection vulnerability in QNAP Turbo NAS firmware versions 3.6.1 Build 0302T and prior, allowing authenticated attackers to execute arbitrary commands via the 'keyword' or 'title' parameters in the QDownload interface. It also highlights insecure cookie storage of credentials.

Description

QNAP Turbo NAS 3.6.1 Build 0302T - Multiple Vulnerabilities

Exploits (1)

exploitdb WRITEUP
by Sense of Security · textwebappshardware
https://www.exploit-db.com/exploits/19263

The advisory describes a command injection vulnerability in QNAP Turbo NAS firmware versions 3.6.1 Build 0302T and prior, allowing authenticated attackers to execute arbitrary commands via the 'keyword' or 'title' parameters in the QDownload interface. It also highlights insecure cookie storage of credentials.

Classification
Writeup 100%
Attack Type
Rce
Complexity
Trivial
Reliability
Reliable
Target: QNAP Turbo NAS (Firmware Version: 3.6.1 Build 0302T and prior)
Auth required
Prerequisites: Authentication to the QNAP web management interface
devstral-2 · analyzed Feb 16, 2026 Full analysis →

Details

Status pre_cve
Tracked Since Feb 18, 2026