CVE-2026-34006
9.3CriticalPublished 15 Oct 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
- Impact
- Full C/I/A compromise
- Weakness
- CWE-306
Impact
Remote, unauthenticated attackers can compromise the system over the network. They need network access to the sMedio DTCP MOVE service.
Root cause
Critical functions lack authentication checks, allowing unauthorized callers to execute them.
Affected systems
sMedio DTCP MOVE versions prior to 1.4.5
CVSS v4.0 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Fix & remediation
Upgrade sMedio DTCP MOVE to version 1.4.5 or later. If patching immediately is not possible, disable or stop the sMedio DTCP MOVE app in QNAP App Center.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
A missing authentication for critical function vulnerability has been reported to affect sMedio DTCP MOVE. If exploited, the vulnerability could allow remote attackers to gain access to the system. We have already fixed the vulnerability in the following version: sMedio DTCP MOVE 1.4.5 and later