CVE-2026-34014
Received Received - Intake

Incorrect Permission Assignment in QNAP Download Station

Publication date: 2026-10-15

Last updated on: 2026-10-15

Assigner: QNAP Systems, Inc.

Description
An incorrect permission assignment for critical resource vulnerability has been reported to affect Download Station. If a local attacker gains an administrator account, they can then exploit the vulnerability to compromise the security of the system. We have already fixed the vulnerability in the following version: Download Station 5.10.1.312 and later Download Station 5.11.2.321 and later

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-15
Last Modified
2026-10-15
Generated
2026-10-15
AI Q&A
2026-10-15
EPSS Evaluated
N/A
NVD
CVE-2026-34014
EUVD
EUVD-2026-101975

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
QNAP Systems Inc. Download Station 5.10.x
QNAP Systems Inc. Download Station 5.11.x

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-732 The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is an incorrect permission assignment vulnerability in QNAP's Download Station software. If an attacker gains administrator access to the system, they can exploit this flaw to compromise the system's security. The issue has been fixed in Download Station versions 5.10.1.312 and later, as well as 5.11.2.321 and later.

Detection Guidance

Check the installed version of Download Station. If it is below 5.10.1.312 or 5.11.2.321, the system is vulnerable. Use the QNAP admin interface or SSH to verify the version.

Impact Analysis

If you are an administrator of a system running an affected version of Download Station, an attacker with administrator privileges could exploit this vulnerability to further compromise your system's security. This could lead to unauthorized access, data breaches, or other malicious activities.

Mitigation Strategies

Update Download Station to version 5.10.1.312 or later, or 5.11.2.321 or later. Ensure no unauthorized administrator accounts exist and restrict local access to administrative privileges.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-34014. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart