CVE-2026-34014
8.4HighPublished 15 Oct 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- High
- User interaction
- None
- Impact
- Full C/I/A compromise
- Weakness
- CWE-732
Impact
A local attacker with an administrator account can fully compromise system security. They require local access and existing admin privileges to exploit it.
Root cause
Incorrect permission assignment to a critical resource allows high-privileged local accounts to escalate access or undermine system security.
Affected systems
QNAP Download Station versions prior to 5.10.1.312 and 5.11.2.321.
CVSS v4.0 · CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Fix & remediation
Upgrade Download Station to version 5.10.1.312, 5.11.2.321, or later via QTS App Center. If patching cannot be done immediately, stop and disable the Download Station application.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
An incorrect permission assignment for critical resource vulnerability has been reported to affect Download Station. If a local attacker gains an administrator account, they can then exploit the vulnerability to compromise the security of the system. We have already fixed the vulnerability in the following version: Download Station 5.10.1.312 and later Download Station 5.11.2.321 and later