Critical QNAP QVR Pro Vulnerability Exposes Surveillance Systems to Remote Attacks QNAP has issued an urgent security advisory addressing a severe vulnerability (CVE-2026-22898) in its QVR Pro surveillance software, which allows unauthenticated remote attackers to gain unauthorized access to affected systems. The flaw, discovered by security researchers at FuzzingLabs, stems from a missing authentication check in critical functions of the QVR Pro application, enabling threat actors to bypass access controls entirely. Affected versions include QVR Pro 2.7.x, and exploitation could grant attackers control over surveillance configurations, live or recorded video feeds, and even lateral movement to other connected devices on the network. Given that network-attached storage (NAS) devices are prime targets for ransomware, botnets, and data extortion, unpatched systems face heightened risks of full compromise and malicious payload deployment. QNAP has released a patch in version 2.7.4.1485, which restores proper authentication checks. Administrators are advised to update immediately via the QTS or QuTS hero interface by navigating to the App Center, locating QVR Pro, and installing the latest version. Successful patch installation should be verified to ensure protection against exploitation.

QNAP Systems disclosed CVE-2025-57714, a critical unquoted search path vulnerability in its NetBak Replicator 4.5.x backup software for Windows. The flaw allows local attackers with standard user access to execute arbitrary code by exploiting improperly quoted directory paths containing spaces. By inserting a malicious executable into a higher-priority path, attackers can hijack the execution flow when the legitimate NetBak Replicator program runs, leading to privilege escalation (potentially to admin level), persistence, and lateral movement across networks.The vulnerability poses a high risk in shared environments (e.g., terminal servers, VDIs, or multi-admin systems), where an attacker could chain this with other exploits to compromise entire infrastructures. While no direct data breach or ransomware is reported, the flaw enables unauthorized code execution, which could facilitate follow-on attacks like data theft, backdoor installation, or system takeover. QNAP patched the issue in version 4.5.15.0807, urging immediate updates alongside defense-in-depth measures (access controls, intrusion detection, and path audits).

Multiple devices from QNAP, a Taiwanese company specialising in NAS storage, was targeted by two types of ransomware, called Qlocker and eCh0raix, that aimed at encrypting their NAS devices for ransom. These two ransomware used the 7zip protocol to encrypt data, created password-protected files and demanded a ransom. With this method, it is possible to recover data from the logs used by 7zip, as long as the computer has not been shut down or restarted. However, QNAP updated its 'Malware Remover' tool to run on affected computers, facilitating the process and recommending contacting technical support. It has also updated various applications used on its devices.